[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH 1/3] hw/misc/arm_sysctl: Fix bad boundary check on m
From: |
Peter Maydell |
Subject: |
[Qemu-devel] [PATCH 1/3] hw/misc/arm_sysctl: Fix bad boundary check on mb clock accesses |
Date: |
Mon, 17 Feb 2014 14:37:32 +0000 |
Fix incorrect use of sizeof() rather than ARRAY_SIZE() to guard
accesses into the mb_clock[] array, which was allowing a malicious
guest to overwrite the end of the array.
Signed-off-by: Peter Maydell <address@hidden>
---
hw/misc/arm_sysctl.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/hw/misc/arm_sysctl.c b/hw/misc/arm_sysctl.c
index 0fc26d2..3fad6f8 100644
--- a/hw/misc/arm_sysctl.c
+++ b/hw/misc/arm_sysctl.c
@@ -276,7 +276,7 @@ static bool vexpress_cfgctrl_read(arm_sysctl_state *s,
unsigned int dcc,
}
break;
case SYS_CFG_OSC:
- if (site == SYS_CFG_SITE_MB && device < sizeof(s->mb_clock)) {
+ if (site == SYS_CFG_SITE_MB && device < ARRAY_SIZE(s->mb_clock)) {
/* motherboard clock */
*val = s->mb_clock[device];
return true;
@@ -324,7 +324,7 @@ static bool vexpress_cfgctrl_write(arm_sysctl_state *s,
unsigned int dcc,
switch (function) {
case SYS_CFG_OSC:
- if (site == SYS_CFG_SITE_MB && device < sizeof(s->mb_clock)) {
+ if (site == SYS_CFG_SITE_MB && device < ARRAY_SIZE(s->mb_clock)) {
/* motherboard clock */
s->mb_clock[device] = val;
return true;
--
1.8.5
- [Qemu-devel] [PATCH 0/3] ARM: three easy patches for coverity-reported issues, Peter Maydell, 2014/02/17
- [Qemu-devel] [PATCH 2/3] hw/net/stellaris_enet: Avoid unintended sign extension, Peter Maydell, 2014/02/17
- [Qemu-devel] [PATCH 3/3] hw/timer/arm_timer: Avoid array overrun for bad addresses, Peter Maydell, 2014/02/17
- [Qemu-devel] [PATCH 1/3] hw/misc/arm_sysctl: Fix bad boundary check on mb clock accesses,
Peter Maydell <=
- Re: [Qemu-devel] [PATCH 0/3] ARM: three easy patches for coverity-reported issues, Paolo Bonzini, 2014/02/17
- Re: [Qemu-devel] [PATCH 0/3] ARM: three easy patches for coverity-reported issues, Andreas Färber, 2014/02/17
- Re: [Qemu-devel] [PATCH 0/3] ARM: three easy patches for coverity-reported issues, Peter Maydell, 2014/02/18
- Re: [Qemu-devel] [PATCH 0/3] ARM: three easy patches for coverity-reported issues, Andreas Färber, 2014/02/18
- Re: [Qemu-devel] [PATCH 0/3] ARM: three easy patches for coverity-reported issues, Peter Maydell, 2014/02/18
- Re: [Qemu-devel] [PATCH 0/3] ARM: three easy patches for coverity-reported issues, Paolo Bonzini, 2014/02/18
- Re: [Qemu-devel] [PATCH 0/3] ARM: three easy patches for coverity-reported issues, Peter Maydell, 2014/02/18
- Re: [Qemu-devel] [PATCH 0/3] ARM: three easy patches for coverity-reported issues, Paolo Bonzini, 2014/02/18
- Re: [Qemu-devel] [PATCH 0/3] ARM: three easy patches for coverity-reported issues, Alexander Graf, 2014/02/18
- Re: [Qemu-devel] [PATCH 0/3] ARM: three easy patches for coverity-reported issues, Peter Maydell, 2014/02/18