diff options
| author | Chris Friedt <chrisfriedt@gmail.com> | 2022-10-18 08:25:49 -0400 |
|---|---|---|
| committer | Thomas Huth <thuth@redhat.com> | 2024-04-30 06:21:47 +0200 |
| commit | 69826741593644f6e9ee735cff37599c33764d67 (patch) | |
| tree | 6b137af3b2642e36dc9ae8ff3c11c089ba908da9 | |
| parent | 046bf2a6184f0a87b89b735ef77edd9a13a96656 (diff) | |
| download | qemu-69826741593644f6e9ee735cff37599c33764d67.zip qemu-69826741593644f6e9ee735cff37599c33764d67.tar.gz qemu-69826741593644f6e9ee735cff37599c33764d67.tar.bz2 | |
hw: misc: edu: fix 2 off-by-one errors
In the case that size1 was zero, because of the explicit
'end1 > addr' check, the range check would fail and the error
message would read as shown below. The correct comparison
is 'end1 >= addr'.
EDU: DMA range 0x40000-0x3ffff out of bounds (0x40000-0x40fff)!
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1254
Signed-off-by: Chris Friedt <cfriedt@meta.com>
[thuth: Adjust patch with regards to the "end1 <= end2" check]
Message-ID: <20221018122551.94567-1-cfriedt@meta.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
| -rw-r--r-- | hw/misc/edu.c | 17 |
1 files changed, 8 insertions, 9 deletions
diff --git a/hw/misc/edu.c b/hw/misc/edu.c index 2a976ca..14250e0 100644 --- a/hw/misc/edu.c +++ b/hw/misc/edu.c @@ -103,19 +103,18 @@ static void edu_lower_irq(EduState *edu, uint32_t val) } } -static bool within(uint64_t addr, uint64_t start, uint64_t end) -{ - return start <= addr && addr < end; -} - -static void edu_check_range(uint64_t addr, uint64_t size1, uint64_t start, - uint64_t size2) +static void edu_check_range(uint64_t addr, uint64_t size1, + uint64_t start, uint64_t size2) { uint64_t end1 = addr + size1; uint64_t end2 = start + size2; - if (within(addr, start, end2) && - end1 > addr && end1 <= end2) { + /* + * 1. ensure we aren't overflowing + * 2. ensure that [addr, end1) is within [start, size2) + */ + if (end2 >= start && end1 >= addr && + addr >= start && end1 <= end2) { return; } |