diff options
| author | Peter Maydell <peter.maydell@linaro.org> | 2018-11-19 15:29:08 +0000 |
|---|---|---|
| committer | Peter Maydell <peter.maydell@linaro.org> | 2018-11-19 15:55:11 +0000 |
| commit | fcf5787c02f7f9ff9f314161631c347d6b69b904 (patch) | |
| tree | 28ad937c82e43539311e15f0994884509c67f86e /hw/usb/dev-mtp.c | |
| parent | 7760da729ac88f112f98f36395ac3b55fc9e4211 (diff) | |
| download | qemu-fcf5787c02f7f9ff9f314161631c347d6b69b904.zip qemu-fcf5787c02f7f9ff9f314161631c347d6b69b904.tar.gz qemu-fcf5787c02f7f9ff9f314161631c347d6b69b904.tar.bz2 | |
hw/block/onenand: Fix off-by-one error allowing out-of-bounds read
An off-by-one error in a switch case in onenand_read() allowed
a misbehaving guest to read off the end of a block of memory.
NB: the onenand device is used only by the "n800" and "n810"
machines, which are usable only with TCG, not KVM, so this is
not a security issue.
Reported-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20181115143535.5885-2-peter.maydell@linaro.org
Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Diffstat (limited to 'hw/usb/dev-mtp.c')
0 files changed, 0 insertions, 0 deletions