diff options
| author | Peter Maydell | 2018-11-19 16:29:08 +0100 |
|---|---|---|
| committer | Peter Maydell | 2018-11-19 16:55:11 +0100 |
| commit | fcf5787c02f7f9ff9f314161631c347d6b69b904 (patch) | |
| tree | 28ad937c82e43539311e15f0994884509c67f86e /linux-user/linux_loop.h | |
| parent | target/arm: fix smc incorrectly trapping to EL3 when secure is off (diff) | |
| download | qemu-fcf5787c02f7f9ff9f314161631c347d6b69b904.tar.gz qemu-fcf5787c02f7f9ff9f314161631c347d6b69b904.tar.xz qemu-fcf5787c02f7f9ff9f314161631c347d6b69b904.zip | |
hw/block/onenand: Fix off-by-one error allowing out-of-bounds read
An off-by-one error in a switch case in onenand_read() allowed
a misbehaving guest to read off the end of a block of memory.
NB: the onenand device is used only by the "n800" and "n810"
machines, which are usable only with TCG, not KVM, so this is
not a security issue.
Reported-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20181115143535.5885-2-peter.maydell@linaro.org
Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Diffstat (limited to 'linux-user/linux_loop.h')
0 files changed, 0 insertions, 0 deletions