From 4ce92b4f38c55931e1573711c6b6f03d996c5812 Mon Sep 17 00:00:00 2001
From: Mark Pizzolato <mark@infocomm.com>
Date: Tue, 28 Feb 2012 13:31:46 -0800
Subject: [PATCH] Fixed overrun bug in eth_devices.

Fixed device name compare in eth_getname_byname to compare the whole name
Removed unused num field in eth_list structure
Extended the number of devices supported since some platforms may have many libpcap accessable devices but only a few basic Ethernet ones
---
 sim_ether.c | 34 ++++++++++++++--------------------
 sim_ether.h |  3 +--
 2 files changed, 15 insertions(+), 22 deletions(-)

diff --git a/sim_ether.c b/sim_ether.c
index 454be442..2de2564f 100644
--- a/sim_ether.c
+++ b/sim_ether.c
@@ -560,7 +560,7 @@ char* eth_getname(int number, char* name)
   ETH_LIST  list[ETH_MAX_DEVICE];
   int count = eth_devices(ETH_MAX_DEVICE, list);
 
-  if (count <= number) return 0;
+  if (count <= number) return NULL;
   strcpy(name, list[number].name);
   return name;
 }
@@ -587,7 +587,7 @@ char* eth_getname_bydesc(char* desc, char* name)
     return name;
   }
   /* not found */
-  return 0;
+  return NULL;
 }
 
 /* strncasecmp() is not available on all platforms */
@@ -621,16 +621,13 @@ char* eth_getname_byname(char* name, char* temp)
   found = 0;
   n = strlen(name);
   for (i=0; i<count && !found; i++) {
-    if (eth_strncasecmp(name, list[i].name, n) == 0) {
+    if ((n == strlen(list[i].name)) &&
+        (eth_strncasecmp(name, list[i].name, n) == 0)) {
       found = 1;
       strcpy(temp, list[i].name); /* only case might be different */
     }
   }
-  if (found) {
-    return temp;
-  } else {
-    return 0;
-  }
+  return (found ? temp : NULL);
 }
 
 void eth_zero(ETH_DEV* dev)
@@ -657,7 +654,7 @@ t_stat eth_show (FILE* st, UNIT* uptr, int32 val, void* desc)
       for (i=0, min=0; i<number; i++)
         if ((len = strlen(list[i].name)) > min) min = len;
       for (i=0; i<number; i++)
-        fprintf(st,"  %d  %-*s (%s)\n", i, (int)min, list[i].name, list[i].desc);
+        fprintf(st," %2d  %-*s (%s)\n", i, (int)min, list[i].name, list[i].desc);
     }
   return SCPE_OK;
 }
@@ -1452,16 +1449,16 @@ if ((strlen(name) == 4)
    ) {
   num = atoi(&name[3]);
   savname = eth_getname(num, temp);
-  if (savname == 0) /* didn't translate */
+  if (savname == NULL) /* didn't translate */
     return SCPE_OPENERR;
   }
 else {
   /* are they trying to use device description? */
   savname = eth_getname_bydesc(name, temp);
-  if (savname == 0) { /* didn't translate */
+  if (savname == NULL) { /* didn't translate */
     /* probably is not ethX and has no description */
     savname = eth_getname_byname(name, temp);
-    if (savname == 0) /* didn't translate */
+    if (savname == NULL) /* didn't translate */
       savname = name;
     }
   }
@@ -2825,7 +2822,6 @@ for (i=0; i<used; i++) {
 
 #ifdef USE_TAP_NETWORK
 if (used < max) {
-  list[used].num = used;
 #if defined(__OpenBSD__)
   sprintf(list[used].name, "%s", "tap:tunN");
 #else
@@ -2837,7 +2833,6 @@ if (used < max) {
 #endif
 #ifdef USE_VDE_NETWORK
 if (used < max) {
-  list[used].num = used;
   sprintf(list[used].name, "%s", "vde:device");
   sprintf(list[used].desc, "%s", "Integrated VDE support");
   ++used;
@@ -2855,6 +2850,7 @@ pcap_if_t* alldevs;
 pcap_if_t* dev;
 char errbuf[PCAP_ERRBUF_SIZE];
 
+memset(list, 0, max*sizeof(*list));
 /* retrieve the device list */
 if (pcap_findalldevs(&alldevs, errbuf) == -1) {
   char* msg = "Eth: error in pcap_findalldevs: %s\r\n";
@@ -2863,15 +2859,13 @@ if (pcap_findalldevs(&alldevs, errbuf) == -1) {
   }
 else {
   /* copy device list into the passed structure */
-  for (i=0, dev=alldevs; dev; dev=dev->next) {
+  for (i=0, dev=alldevs; dev && (i < max); dev=dev->next, ++i) {
     if ((dev->flags & PCAP_IF_LOOPBACK) || (!strcmp("any", dev->name))) continue;
-    list[i].num = i;
-    sprintf(list[i].name, "%s", dev->name);
+    strncpy(list[i].name, dev->name, sizeof(list[i].name)-1);
     if (dev->description)
-      sprintf(list[i].desc, "%s", dev->description);
+      strncpy(list[i].desc, dev->description, sizeof(list[i].desc)-1);
     else
-      sprintf(list[i].desc, "%s", "No description available");
-    if (i++ >= max) break;
+      strncpy(list[i].desc, "No description available", sizeof(list[i].desc)-1);
     }
 
   /* free device list */
diff --git a/sim_ether.h b/sim_ether.h
index 2314e835..8200116e 100644
--- a/sim_ether.h
+++ b/sim_ether.h
@@ -130,7 +130,7 @@
 #define ETH_MIN_PACKET        60                        /* minimum ethernet packet size */
 #define ETH_MAX_PACKET      1514                        /* maximum ethernet packet size */
 #define ETH_MAX_JUMBO_FRAME 65536                       /* maximum ethernet jumbo frame size (or Offload Segment Size) */
-#define ETH_MAX_DEVICE        10                        /* maximum ethernet devices */
+#define ETH_MAX_DEVICE        20                        /* maximum ethernet devices */
 #define ETH_CRC_SIZE           4                        /* ethernet CRC size */
 #define ETH_FRAME_SIZE (ETH_MAX_PACKET+ETH_CRC_SIZE)    /* ethernet maximum frame size */
 #define ETH_MIN_JUMBO_FRAME ETH_MAX_PACKET              /* Threshold size for Jumbo Frame Processing */
@@ -168,7 +168,6 @@ struct eth_queue {
 };
 
 struct eth_list {
-  int     num;
   char    name[ETH_DEV_NAME_MAX];
   char    desc[ETH_DEV_DESC_MAX];
 };