diff options
| author | Mark Cave-Ayland | 2014-05-24 12:51:50 +0200 |
|---|---|---|
| committer | Mark Cave-Ayland | 2014-06-05 21:51:30 +0200 |
| commit | 366d4f7e0007a5540897fbac6e377c57d8c79a73 (patch) | |
| tree | 413fb8f72f65ac9521a570c35347a6c50530593d /scripts | |
| parent | cg3: move initialisation from realizefn to initfn (diff) | |
| download | qemu-366d4f7e0007a5540897fbac6e377c57d8c79a73.tar.gz qemu-366d4f7e0007a5540897fbac6e377c57d8c79a73.tar.xz qemu-366d4f7e0007a5540897fbac6e377c57d8c79a73.zip | |
cg3: add extra check to prevent CG3 register array overflow
The case statements in the CG3 read and write register routines have a maximum
value of CG3_REG_SIZE, so if a value were written to this offset then it
would overflow the register array.
Currently this cannot be exploited since the MemoryRegion restricts accesses
to the range 0 ... CG3_REG_SIZE - 1, but it seems worth clarifying this for
future review and/or static analysis.
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
CC: Paolo Bonzini <pbonzini@redhat.com>
Diffstat (limited to 'scripts')
0 files changed, 0 insertions, 0 deletions