From: Cédric Le Goater Date: Mon, 26 Jan 2026 14:18:20 +0000 (+0100) Subject: hw/adc: Fix out-of-bounds write in Aspeed ADC model X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=4c6521296d2b6820ab1f8c59d3a80cd0c138b2d8;p=thirdparty%2Fqemu.git hw/adc: Fix out-of-bounds write in Aspeed ADC model The 'regs' array has ASPEED_ADC_NR_REGS (52) elements, while the memory region covers offsets 0x00-0xFC. The aspeed_adc_engine_write() function has an out-of-bounds write vulnerability when accessing unimplemented registers. Fix this by using 'return' instead of 'break' in the default case, which prevents execution from reaching the s->regs[reg] assignment for unimplemented registers. Reported-by: Elhrj Saad Fixes: 5857974d5d11 ("hw/adc: Add basic Aspeed ADC model") Reviewed-by: Philippe Mathieu-Daudé Link: https://lore.kernel.org/qemu-devel/20260126141820.719492-1-clg@redhat.com Signed-off-by: Cédric Le Goater --- diff --git a/hw/adc/aspeed_adc.c b/hw/adc/aspeed_adc.c index fd3af30829..3cc75bbcd6 100644 --- a/hw/adc/aspeed_adc.c +++ b/hw/adc/aspeed_adc.c @@ -228,7 +228,8 @@ static void aspeed_adc_engine_write(void *opaque, hwaddr addr, uint64_t value, qemu_log_mask(LOG_UNIMP, "%s: engine[%u]: " "0x%" HWADDR_PRIx " 0x%" PRIx64 "\n", __func__, s->engine_id, addr, value); - break; + /* Do not update the regs[] array */ + return; } s->regs[reg] = value;