diff options
| author | Nicholas Piggin <npiggin@gmail.com> | 2024-08-07 01:13:21 +1000 |
|---|---|---|
| committer | Nicholas Piggin <npiggin@gmail.com> | 2024-11-04 09:08:58 +1000 |
| commit | ddd2a060a0da41000ddca31e329ab1d54e37fedb (patch) | |
| tree | f3615335329066e3879f106953a2497295e890a1 /event-loop-base.c | |
| parent | fdd9cf281d6c07c23f620d14896f97de6c4356b9 (diff) | |
ppc/pnv: ADU fix possible buffer overrun with invalid size
The ADU LPC transfer-size field is 7 bits, but the supported sizes for
LPC access via ADU appear to be 1, 2, 4, 8. The data buffer could
overrun if firmware set an invalid size field, so add checks to reject
them with a message.
Cc: qemu-stable@nongnu.org
Reported-by: Cédric Le Goater <clg@redhat.com>
Resolves: Coverity CID 1558830
Fixes: 24bd283bccb33 ("ppc/pnv: Implement ADU access to LPC space")
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Diffstat (limited to 'event-loop-base.c')
0 files changed, 0 insertions, 0 deletions