]> git.ipfire.org Git - thirdparty/qemu.git/commit
ppc/pnv: ADU fix possible buffer overrun with invalid size
authorNicholas Piggin <npiggin@gmail.com>
Tue, 6 Aug 2024 15:13:21 +0000 (01:13 +1000)
committerMichael Tokarev <mjt@tls.msk.ru>
Tue, 5 Nov 2024 15:57:35 +0000 (18:57 +0300)
commita16570419b4fe31dc426e3f54979b9dd92aac48e
treed8eaaa9db65afec640a4e69939c4441e727ba9b1
parent963bfe9c6288a3b2cb6215b889de1b8efce39d5d
ppc/pnv: ADU fix possible buffer overrun with invalid size

The ADU LPC transfer-size field is 7 bits, but the supported sizes for
LPC access via ADU appear to be 1, 2, 4, 8. The data buffer could
overrun if firmware set an invalid size field, so add checks to reject
them with a message.

Cc: qemu-stable@nongnu.org
Reported-by: Cédric Le Goater <clg@redhat.com>
Resolves: Coverity CID 1558830
Fixes: 24bd283bccb33 ("ppc/pnv: Implement ADU access to LPC space")
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
(cherry picked from commit ddd2a060a0da41000ddca31e329ab1d54e37fedb)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
hw/ppc/pnv_adu.c