From: Helge Deller <[email protected]> Insert the source address after the destination instead of overwriting bytes 6-11.
Noticed-by: Keith Monahan <[email protected]> Signed-off-by: Helge Deller <[email protected]> --- hw/net/i82596.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/hw/net/i82596.c b/hw/net/i82596.c index 6bcae73815..19e1bf47db 100644 --- a/hw/net/i82596.c +++ b/hw/net/i82596.c @@ -631,8 +631,14 @@ static int i82596_tx_process_frame(I82596State *s) return 0; } - if (I596_NO_SRC_ADD_IN == 0 && total_len >= ETH_ALEN * 2) { + if (I596_NO_SRC_ADD_IN == 0 && total_len >= ETH_ALEN) { + if (total_len + ETH_ALEN > sizeof(s->tx_buffer)) { + return 0; + } + memmove(&s->tx_buffer[ETH_ALEN * 2], &s->tx_buffer[ETH_ALEN], + total_len - ETH_ALEN); memcpy(&s->tx_buffer[ETH_ALEN], s->conf.macaddr.a, ETH_ALEN); + total_len += ETH_ALEN; } if (I596_PADDING && total_len < I596_MIN_FRAME_LEN) { -- 2.54.0
