[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 2/9] highbank: validate register offset before access
From: |
Peter Maydell |
Subject: |
[Qemu-devel] [PULL 2/9] highbank: validate register offset before access |
Date: |
Mon, 13 Nov 2017 14:11:37 +0000 |
From: Prasad J Pandit <address@hidden>
An 'offset' parameter sent to highbank register r/w functions
could be greater than number(NUM_REGS=0x200) of hb registers,
leading to an OOB access issue. Add check to avoid it.
Reported-by: Moguofang (Dennis mo) <address@hidden>
Signed-off-by: Prasad J Pandit <address@hidden>
Message-id: address@hidden
Reviewed-by: Peter Maydell <address@hidden>
Signed-off-by: Peter Maydell <address@hidden>
---
hw/arm/highbank.c | 17 +++++++++++++++--
1 file changed, 15 insertions(+), 2 deletions(-)
diff --git a/hw/arm/highbank.c b/hw/arm/highbank.c
index 354c6b2..287392b 100644
--- a/hw/arm/highbank.c
+++ b/hw/arm/highbank.c
@@ -34,6 +34,7 @@
#include "hw/ide/ahci.h"
#include "hw/cpu/a9mpcore.h"
#include "hw/cpu/a15mpcore.h"
+#include "qemu/log.h"
#define SMP_BOOT_ADDR 0x100
#define SMP_BOOT_REG 0x40
@@ -117,14 +118,26 @@ static void hb_regs_write(void *opaque, hwaddr offset,
}
}
- regs[offset/4] = value;
+ if (offset / 4 >= NUM_REGS) {
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "highbank: bad write offset 0x%" HWADDR_PRIx "\n", offset);
+ return;
+ }
+ regs[offset / 4] = value;
}
static uint64_t hb_regs_read(void *opaque, hwaddr offset,
unsigned size)
{
+ uint32_t value;
uint32_t *regs = opaque;
- uint32_t value = regs[offset/4];
+
+ if (offset / 4 >= NUM_REGS) {
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "highbank: bad read offset 0x%" HWADDR_PRIx "\n", offset);
+ return 0;
+ }
+ value = regs[offset / 4];
if ((offset == 0x100) || (offset == 0x108) || (offset == 0x10C)) {
value |= 0x30000000;
--
2.7.4
- [Qemu-devel] [PULL 0/9] target-arm queue, Peter Maydell, 2017/11/13
- [Qemu-devel] [PULL 6/9] xlnx-zcu102: Add an info message deprecating the EP108, Peter Maydell, 2017/11/13
- [Qemu-devel] [PULL 7/9] xlnx-zcu102: Specify the max number of CPUs for the EP108, Peter Maydell, 2017/11/13
- [Qemu-devel] [PULL 9/9] accel/tcg/translate-all: expand cpu_restore_state addr check, Peter Maydell, 2017/11/13
- [Qemu-devel] [PULL 8/9] hw: add .min_cpus and .default_cpus fields to machine_class, Peter Maydell, 2017/11/13
- [Qemu-devel] [PULL 3/9] MAINTAINERS: Add entries for Smartfusion2, Peter Maydell, 2017/11/13
- [Qemu-devel] [PULL 4/9] qom: move CPUClass.tcg_initialize to a global, Peter Maydell, 2017/11/13
- [Qemu-devel] [PULL 5/9] xlnx-zynqmp: Properly support the smp command line option, Peter Maydell, 2017/11/13
- [Qemu-devel] [PULL 2/9] highbank: validate register offset before access,
Peter Maydell <=
- [Qemu-devel] [PULL 1/9] arm/translate-a64: mark path as unreachable to eliminate warning, Peter Maydell, 2017/11/13
- Re: [Qemu-devel] [PULL 0/9] target-arm queue, Peter Maydell, 2017/11/14