From 68716da745858ca86ac587d14ac553051e5f04eb Mon Sep 17 00:00:00 2001 From: Stefan Weil Date: Mon, 9 Jun 2014 16:19:29 +0200 Subject: [PATCH] apb: Fix out-of-bounds array write access The array regs is declared with IOMMU_NREGS (3) elements and accessed using IOMMU_CTRL (0) and IOMMU_BASE (8). In most cases, those values are right shifted before being used as an index which results in indices 0 and 1. In one case, this right shift was missing for IOMMU_BASE which results in an out-of-bounds write access with index 8. The patch adds the missing shift operation also for IOMMU_CTRL where it is needed only for cosmetic reasons. Signed-off-by: Stefan Weil Signed-off-by: Mark Cave-Ayland --- hw/pci-host/apb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/hw/pci-host/apb.c b/hw/pci-host/apb.c index 6fa2723449..d238a84f95 100644 --- a/hw/pci-host/apb.c +++ b/hw/pci-host/apb.c @@ -333,7 +333,7 @@ static void iommu_config_write(void *opaque, hwaddr addr, is->regs[IOMMU_CTRL >> 3] &= 0xffffffffULL; is->regs[IOMMU_CTRL >> 3] |= val << 32; } else { - is->regs[IOMMU_CTRL] = val; + is->regs[IOMMU_CTRL >> 3] = val; } break; case IOMMU_CTRL + 0x4: @@ -345,7 +345,7 @@ static void iommu_config_write(void *opaque, hwaddr addr, is->regs[IOMMU_BASE >> 3] &= 0xffffffffULL; is->regs[IOMMU_BASE >> 3] |= val << 32; } else { - is->regs[IOMMU_BASE] = val; + is->regs[IOMMU_BASE >> 3] = val; } break; case IOMMU_BASE + 0x4: