haraldwolff/qemu-patch-raspberry4
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

apb: Fix out-of-bounds array write access

Browse source 
The array regs is declared with IOMMU_NREGS (3) elements and accessed
using IOMMU_CTRL (0) and IOMMU_BASE (8). In most cases, those values
are right shifted before being used as an index which results in indices
0 and 1. In one case, this right shift was missing for IOMMU_BASE which
results in an out-of-bounds write access with index 8.

The patch adds the missing shift operation also for IOMMU_CTRL where
it is needed only for cosmetic reasons.

Signed-off-by: Stefan Weil <sw@weilnetz.de>
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
This commit is contained in:
Stefan Weil 2014-06-09 16:19:29 +02:00 committed by Mark Cave-Ayland
parent 427e1750a0
commit 68716da745
1 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
hw/pci-host/apb.c
View file

@ -333,7 +333,7 @@ static void iommu_config_write(void *opaque, hwaddr addr,
is->regs[IOMMU_CTRL >> 3] &= 0xffffffffULL;
is->regs[IOMMU_CTRL >> 3] |= val << 32;
} else {
is->regs[IOMMU_CTRL] = val;
is->regs[IOMMU_CTRL >> 3] = val;
}
break;
case IOMMU_CTRL + 0x4:
@ -345,7 +345,7 @@ static void iommu_config_write(void *opaque, hwaddr addr,
is->regs[IOMMU_BASE >> 3] &= 0xffffffffULL;
is->regs[IOMMU_BASE >> 3] |= val << 32;
} else {
is->regs[IOMMU_BASE] = val;
is->regs[IOMMU_BASE >> 3] = val;
}
break;
case IOMMU_BASE + 0x4: