aboutsummaryrefslogtreecommitdiff
path: root/bt-host.c
diff options
context:
space:
mode:
authorPeter Maydell <peter.maydell@linaro.org>2018-07-16 17:18:41 +0100
committerPeter Maydell <peter.maydell@linaro.org>2018-07-16 17:18:41 +0100
commitee03cca88ec2e4cd1ffd319764cced1cab707ee2 (patch)
treee90014334432f9f0e1ea5a1a82be1058cd710d8e /bt-host.c
parent333b9c8a684c58f6711521e446e4b26de5addadc (diff)
downloadqemu-ee03cca88ec2e4cd1ffd319764cced1cab707ee2.zip
qemu-ee03cca88ec2e4cd1ffd319764cced1cab707ee2.tar.gz
qemu-ee03cca88ec2e4cd1ffd319764cced1cab707ee2.tar.bz2
hw/intc/arm_gic: Check interrupt number in gic_deactivate_irq()
In gic_deactivate_irq() the interrupt number comes from the guest (on a write to the GICC_DIR register), so we need to sanity check that it isn't out of range before we use it as an array index. Handle this in a similar manner to the check we do in gic_complete_irq() for the GICC_EOI register. The array overrun is not disastrous because the calling code uses (value & 0x3ff) to extract the interrupt field, so the only out-of-range values possible are 1020..1023, which allow overrunning only from irq_state[] into the following irq_target[] array which the guest can already manipulate. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Luc Michel <luc.michel@greensocs.com> Message-id: 20180712154152.32183-2-peter.maydell@linaro.org
Diffstat (limited to 'bt-host.c')
0 files changed, 0 insertions, 0 deletions