From: Samuel Obuch <samuel.ob...@codasip.com>

The maximum length is capped similarly to the emaclite_send function.
Avoid integer underflow for values of ip->ip_len < 30, the minimum
length of an IP packet is 21 bytes.

Signed-off-by: Samuel Obuch <samuel.ob...@codasip.com>
---
 drivers/net/xilinx_emaclite.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/xilinx_emaclite.c b/drivers/net/xilinx_emaclite.c
index a4851ad36f..16ba915fba 100644
--- a/drivers/net/xilinx_emaclite.c
+++ b/drivers/net/xilinx_emaclite.c
@@ -517,6 +517,8 @@ try_again:
                length = ntohs(ip->ip_len);
                length += ETHER_HDR_SIZE + ETH_FCS_LEN;
                debug("IP Packet %x\n", length);
+               if (length > PKTSIZE)
+                       length = PKTSIZE;
                break;
        default:
                debug("Other Packet\n");
@@ -525,7 +527,7 @@ try_again:
        }
 
        /* Read the rest of the packet which is longer then first read */
-       if (length != first_read)
+       if (length > first_read)
                xemaclite_alignedread(addr + first_read,
                                      etherrxbuff + first_read,
                                      length - first_read);
-- 
2.31.1

Reply via email to