]> git.ipfire.org Git - thirdparty/qemu.git/commit
ppc/pnv: ADU fix possible buffer overrun with invalid size
authorNicholas Piggin <npiggin@gmail.com>
Tue, 6 Aug 2024 15:13:21 +0000 (01:13 +1000)
committerNicholas Piggin <npiggin@gmail.com>
Sun, 3 Nov 2024 23:08:58 +0000 (09:08 +1000)
commitddd2a060a0da41000ddca31e329ab1d54e37fedb
treef3615335329066e3879f106953a2497295e890a1
parentfdd9cf281d6c07c23f620d14896f97de6c4356b9
ppc/pnv: ADU fix possible buffer overrun with invalid size

The ADU LPC transfer-size field is 7 bits, but the supported sizes for
LPC access via ADU appear to be 1, 2, 4, 8. The data buffer could
overrun if firmware set an invalid size field, so add checks to reject
them with a message.

Cc: qemu-stable@nongnu.org
Reported-by: Cédric Le Goater <clg@redhat.com>
Resolves: Coverity CID 1558830
Fixes: 24bd283bccb33 ("ppc/pnv: Implement ADU access to LPC space")
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
hw/ppc/pnv_adu.c