diff options
| author | Paolo Bonzini | 2016-07-04 14:06:37 +0200 |
|---|---|---|
| committer | Peter Maydell | 2016-07-04 14:15:22 +0200 |
| commit | b68cb06093a36bd6fbd4d06cd62c08629fea2242 (patch) | |
| tree | 0174660ddc51301f91226784843eeaf9678cfe55 /scripts | |
| parent | m25p80: do not put iovec on the stack (diff) | |
| download | qemu-b68cb06093a36bd6fbd4d06cd62c08629fea2242.tar.gz qemu-b68cb06093a36bd6fbd4d06cd62c08629fea2242.tar.xz qemu-b68cb06093a36bd6fbd4d06cd62c08629fea2242.zip | |
m25p80: avoid out of bounds accesses
s->cur_addr can be made to point outside s->storage, either by
writing a value >= 128 to s->ear (because s->ear * MAX_3BYTES_SIZE
is a signed integer and sign-extends into the 64-bit cur_addr),
or just by writing an address beyond the size of the flash being
emulated. Avoid the sign extension to make the code cleaner, and
on top of that mask s->cur_addr to s->size.
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-id: 1467138270-32481-4-git-send-email-clg@kaod.org
Reviewed by: Marcin Krzeminski <marcin.krzeminski@nokia.com>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Diffstat (limited to 'scripts')
0 files changed, 0 insertions, 0 deletions