--- xen-unstable/tools/ioemu/hw/ne2000.c.cve-2007-1321 2006-07-03 09:51:06.000000000 -0400 +++ xen-unstable/tools/ioemu/hw/ne2000.c 2007-10-30 14:32:59.000000000 -0400 @@ -205,7 +205,7 @@ static void ne2000_receive(void *opaque, { NE2000State *s = opaque; uint8_t *p; - int total_len, next, avail, len, index; + unsigned int total_len, next, avail, len, index; uint8_t buf1[60]; #if defined(DEBUG_NE2000) @@ -241,7 +241,10 @@ static void ne2000_receive(void *opaque, /* write packet data */ while (size > 0) { - avail = s->stop - index; + if (index <= s->stop) + avail = s->stop - index; + else + avail = 0; len = size; if (len > avail) len = avail;