read_payload_3270() decremented in_len after consuming bytes but
never shifted the remaining data to the front of the buffer.
Subsequent reads and appends in terminal_read (at &t->inv[t->in_len])
would reference wrong positions, re-processing stale bytes.
Add a memmove to compact the buffer after consuming a payload.
Fixes: 2dc95b4cac5e ("s390x/3270: 3270 data stream handling")
Reported-by: Pavee Hui <[email protected]>
Signed-off-by: Marc-André Lureau <[email protected]>
---
hw/char/terminal3270.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/hw/char/terminal3270.c b/hw/char/terminal3270.c
index 8247a07a54e6..506c7a77eac1 100644
--- a/hw/char/terminal3270.c
+++ b/hw/char/terminal3270.c
@@ -205,6 +205,9 @@ static int read_payload_3270(EmulatedCcw3270Device *dev)
return ret;
}
t->in_len -= len;
+ if (t->in_len > 0) {
+ memmove(t->inv, &t->inv[len], t->in_len);
+ }
return len;
}
--
2.56.0.rc0.29.g47ce80527c56
