aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorPeter Maydell <peter.maydell@linaro.org>2015-07-30 16:33:42 +0100
committerLeon Alrae <leon.alrae@imgtec.com>2015-08-13 16:22:53 +0100
commit58d479786b11a7e982419c1e0905b8490ef9a787 (patch)
tree459c19694ea1d9b3ca3dea7b5352f28f05aaa447
parenteb02cc3f89013612cb05df23b5441741e902bbd2 (diff)
hw/pci-host/bonito: Avoid buffer overrun for bad LDMA/COP accesses
The LDMA and COP memory regions represent four 32 bit registers each, but the memory regions themselves are 0x100 bytes large. Add guards to the read and write accessors so that bogus accesses beyond the four defined registers don't just run off the end of the bonldma and boncop structs and into whatever lies beyond. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Acked-by: Aurelien Jarno <aurelien@aurel32.net> Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
-rw-r--r--hw/pci-host/bonito.c16
1 files changed, 16 insertions, 0 deletions
diff --git a/hw/pci-host/bonito.c b/hw/pci-host/bonito.c
index 3a731fe18d..4139a2c468 100644
--- a/hw/pci-host/bonito.c
+++ b/hw/pci-host/bonito.c
@@ -355,6 +355,10 @@ static uint64_t bonito_ldma_readl(void *opaque, hwaddr addr,
uint32_t val;
PCIBonitoState *s = opaque;
+ if (addr >= sizeof(s->bonldma)) {
+ return 0;
+ }
+
val = ((uint32_t *)(&s->bonldma))[addr/sizeof(uint32_t)];
return val;
@@ -365,6 +369,10 @@ static void bonito_ldma_writel(void *opaque, hwaddr addr,
{
PCIBonitoState *s = opaque;
+ if (addr >= sizeof(s->bonldma)) {
+ return;
+ }
+
((uint32_t *)(&s->bonldma))[addr/sizeof(uint32_t)] = val & 0xffffffff;
}
@@ -384,6 +392,10 @@ static uint64_t bonito_cop_readl(void *opaque, hwaddr addr,
uint32_t val;
PCIBonitoState *s = opaque;
+ if (addr >= sizeof(s->boncop)) {
+ return 0;
+ }
+
val = ((uint32_t *)(&s->boncop))[addr/sizeof(uint32_t)];
return val;
@@ -394,6 +406,10 @@ static void bonito_cop_writel(void *opaque, hwaddr addr,
{
PCIBonitoState *s = opaque;
+ if (addr >= sizeof(s->boncop)) {
+ return;
+ }
+
((uint32_t *)(&s->boncop))[addr/sizeof(uint32_t)] = val & 0xffffffff;
}