system/qemu
system/qemu
1
0
Fork 0
mirror of https://gitlab.com/qemu-project/qemu synced 2024-09-16 01:03:31 +00:00
Code Issues Packages Projects Releases Wiki Activity

hw/pci-host/bonito: Avoid buffer overrun for bad LDMA/COP accesses

Browse source 
The LDMA and COP memory regions represent four 32 bit registers
each, but the memory regions themselves are 0x100 bytes large.
Add guards to the read and write accessors so that bogus accesses
beyond the four defined registers don't just run off the end of
the bonldma and boncop structs and into whatever lies beyond.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Acked-by: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
This commit is contained in:
Peter Maydell 2015-07-30 16:33:42 +01:00 committed by Leon Alrae
parent eb02cc3f89
commit 58d479786b
1 changed files with 16 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
hw/pci-host/bonito.c
View file

@ -355,6 +355,10 @@ static uint64_t bonito_ldma_readl(void *opaque, hwaddr addr,
uint32_t val;
PCIBonitoState *s = opaque;
if (addr >= sizeof(s->bonldma)) {
return 0;
}
val = ((uint32_t *)(&s->bonldma))[addr/sizeof(uint32_t)];
return val;
@ -365,6 +369,10 @@ static void bonito_ldma_writel(void *opaque, hwaddr addr,
{
PCIBonitoState *s = opaque;
if (addr >= sizeof(s->bonldma)) {
return;
}
((uint32_t *)(&s->bonldma))[addr/sizeof(uint32_t)] = val & 0xffffffff;
}
@ -384,6 +392,10 @@ static uint64_t bonito_cop_readl(void *opaque, hwaddr addr,
uint32_t val;
PCIBonitoState *s = opaque;
if (addr >= sizeof(s->boncop)) {
return 0;
}
val = ((uint32_t *)(&s->boncop))[addr/sizeof(uint32_t)];
return val;
@ -394,6 +406,10 @@ static void bonito_cop_writel(void *opaque, hwaddr addr,
{
PCIBonitoState *s = opaque;
if (addr >= sizeof(s->boncop)) {
return;
}
((uint32_t *)(&s->boncop))[addr/sizeof(uint32_t)] = val & 0xffffffff;
}