gt_sdma_handle_rxqueue truncates the value of pkt_len:
|
/* Truncate the packet if it is too big */ |
|
pkt_len = m_min(pkt_len,GT_MAX_PKT_SIZE); |
but the only use of pkt_len happens before that, in line 1094.
Possible consequence: a big packet might cause a buffer overflow (probably in the vm memory instead of dynamips itself)
Discovered while converting to rust.