rx_desc_len is migrated as a raw uint8_t from the stream in both e1000e and igb, but it is a derived value that can be computed from the register state. A crafted migration stream can set rx_desc_len to an invalid value, causing a stack buffer overflow in e1000e_write_packet_to_guest() which copies rx_desc_len bytes into a 32-byte stack union.
Recalculate rx_desc_len from the register state in post_load, ignoring the untrusted value from the stream. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3869 Laurent Vivier (2): hw/net/e1000e: recalculate rx_desc_len on migration load hw/net/igb: recalculate rx_desc_len on migration load hw/net/e1000e_core.c | 2 ++ hw/net/igb_core.c | 2 ++ 2 files changed, 4 insertions(+) -- 2.54.0
