diff options
| author | Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> | 2014-05-24 11:51:50 +0100 |
|---|---|---|
| committer | Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> | 2014-06-05 20:51:30 +0100 |
| commit | 366d4f7e0007a5540897fbac6e377c57d8c79a73 (patch) | |
| tree | 413fb8f72f65ac9521a570c35347a6c50530593d /hw | |
| parent | e09c49f40de32620e99f67a71d4508c7fe97dd84 (diff) | |
| download | qemu-366d4f7e0007a5540897fbac6e377c57d8c79a73.zip qemu-366d4f7e0007a5540897fbac6e377c57d8c79a73.tar.gz qemu-366d4f7e0007a5540897fbac6e377c57d8c79a73.tar.bz2 | |
cg3: add extra check to prevent CG3 register array overflow
The case statements in the CG3 read and write register routines have a maximum
value of CG3_REG_SIZE, so if a value were written to this offset then it
would overflow the register array.
Currently this cannot be exploited since the MemoryRegion restricts accesses
to the range 0 ... CG3_REG_SIZE - 1, but it seems worth clarifying this for
future review and/or static analysis.
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
CC: Paolo Bonzini <pbonzini@redhat.com>
Diffstat (limited to 'hw')
| -rw-r--r-- | hw/display/cg3.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/hw/display/cg3.c b/hw/display/cg3.c index cd9297d..65ef7a7 100644 --- a/hw/display/cg3.c +++ b/hw/display/cg3.c @@ -177,7 +177,7 @@ static uint64_t cg3_reg_read(void *opaque, hwaddr addr, unsigned size) /* monitor ID 6, board type = 1 (color) */ val = s->regs[1] | CG3_SR_1152_900_76_B | CG3_SR_ID_COLOR; break; - case CG3_REG_FBC_CURSTART ... CG3_REG_SIZE: + case CG3_REG_FBC_CURSTART ... CG3_REG_SIZE - 1: val = s->regs[addr - 0x10]; break; default: @@ -247,7 +247,7 @@ static void cg3_reg_write(void *opaque, hwaddr addr, uint64_t val, qemu_irq_lower(s->irq); } break; - case CG3_REG_FBC_CURSTART ... CG3_REG_SIZE: + case CG3_REG_FBC_CURSTART ... CG3_REG_SIZE - 1: s->regs[addr - 0x10] = val; break; default: |