mirror of
https://gitlab.com/qemu-project/qemu
synced 2024-09-06 18:05:37 +00:00
esp: don't underflow cmdfifo in do_cmd()
If the guest tries to execute a CDB when cmdfifo is not empty before the start of the message out phase then clearing the message out phase data will cause cmdfifo to underflow due to cmdfifo_cdb_offset being larger than the amount of data within. Since this can only occur by issuing deliberately incorrect instruction sequences, ensure that the maximum length of esp_fifo_pop_buf() is limited to the size of the data within cmdfifo. Buglink: https://bugs.launchpad.net/qemu/+bug/1909247 Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20210407195801.685-8-mark.cave-ayland@ilande.co.uk>
This commit is contained in:
parent
9954575173
commit
fa7505c154
|
@ -319,13 +319,15 @@ static void do_busid_cmd(ESPState *s, uint8_t busid)
|
|||
|
||||
static void do_cmd(ESPState *s)
|
||||
{
|
||||
uint8_t busid = fifo8_pop(&s->cmdfifo);
|
||||
uint8_t busid = esp_fifo_pop(&s->cmdfifo);
|
||||
int len;
|
||||
|
||||
s->cmdfifo_cdb_offset--;
|
||||
|
||||
/* Ignore extended messages for now */
|
||||
if (s->cmdfifo_cdb_offset) {
|
||||
esp_fifo_pop_buf(&s->cmdfifo, NULL, s->cmdfifo_cdb_offset);
|
||||
len = MIN(s->cmdfifo_cdb_offset, fifo8_num_used(&s->cmdfifo));
|
||||
esp_fifo_pop_buf(&s->cmdfifo, NULL, len);
|
||||
s->cmdfifo_cdb_offset = 0;
|
||||
}
|
||||
|
||||
|
|
Loading…
Reference in a new issue