net: tulip: check frame size and r/w data length

net: tulip: check frame size and r/w data length

Tulip network driver while copying tx/rx buffers does not check
frame size against r/w data length. This may lead to OOB buffer
access. Add check to avoid it.

Limit iterations over descriptors to avoid potential infinite
loop issue in tulip_xmit_list_update.

Reported-by: Li Qiang <[email protected]>
Reported-by: Ziming Zhang <[email protected]>
Reported-by: Jason Wang <[email protected]>
Tested-by: Li Qiang <[email protected]>
Reviewed-by: Li Qiang <[email protected]>
Signed-off-by: Prasad J Pandit <[email protected]>
Signed-off-by: Jason Wang <[email protected]>