system/qemu
system/qemu
1
0
Fork 0
mirror of https://gitlab.com/qemu-project/qemu synced 2024-11-05 20:35:44 +00:00
Code Issues Projects Releases Packages Wiki Activity

highbank: validate register offset before access

Browse source 
An 'offset' parameter sent to highbank register r/w functions
could be greater than number(NUM_REGS=0x200) of hb registers,
leading to an OOB access issue. Add check to avoid it.

Reported-by: Moguofang (Dennis mo) <moguofang@huawei.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Message-id: 20171113062658.9697-1-ppandit@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
This commit is contained in:
Prasad J Pandit 2017-11-13 13:55:24 +00:00 committed by Peter Maydell
parent 5ca66278c8
commit c5c752af8c
1 changed files with 15 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
hw/arm/highbank.c
View file

@ -34,6 +34,7 @@
#include "hw/ide/ahci.h"
#include "hw/cpu/a9mpcore.h"
#include "hw/cpu/a15mpcore.h"
#include "qemu/log.h"
#define SMP_BOOT_ADDR 0x100
#define SMP_BOOT_REG 0x40
@ -117,14 +118,26 @@ static void hb_regs_write(void *opaque, hwaddr offset,
}
}
regs[offset/4] = value;
if (offset / 4 >= NUM_REGS) {
qemu_log_mask(LOG_GUEST_ERROR,
"highbank: bad write offset 0x%" HWADDR_PRIx "\n", offset);
return;
}
regs[offset / 4] = value;
}
static uint64_t hb_regs_read(void *opaque, hwaddr offset,
unsigned size)
{
uint32_t value;
uint32_t *regs = opaque;
uint32_t value = regs[offset/4];
if (offset / 4 >= NUM_REGS) {
qemu_log_mask(LOG_GUEST_ERROR,
"highbank: bad read offset 0x%" HWADDR_PRIx "\n", offset);
return 0;
}
value = regs[offset / 4];
if ((offset == 0x100) || (offset == 0x108) || (offset == 0x10C)) {
value |= 0x30000000;