diff options
| author | Peter Maydell <peter.maydell@linaro.org> | 2014-02-26 17:19:57 +0000 |
|---|---|---|
| committer | Michael Roth <mdroth@linux.vnet.ibm.com> | 2014-02-27 09:37:43 -0600 |
| commit | e498311693377ee6aa599a37c643d364f7072170 (patch) | |
| tree | 64da1810ea2af76d5aa56c19b4d3dd2f50c6c6a4 /hw/timer/arm_timer.c | |
| parent | 4736fb34f7d6ca2962c0a943ca4835fd25ca6140 (diff) | |
hw/misc/arm_sysctl: Fix bad boundary check on mb clock accesses
Fix incorrect use of sizeof() rather than ARRAY_SIZE() to guard
accesses into the mb_clock[] array, which was allowing a malicious
guest to overwrite the end of the array.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Andreas Färber <afaerber@suse.de>
Message-id: 1392647854-8067-2-git-send-email-peter.maydell@linaro.org
Cc: qemu-stable@nongnu.org
(cherry picked from commit ec1efab95767312ff4afb816d0d4b548e093b031)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Diffstat (limited to 'hw/timer/arm_timer.c')
0 files changed, 0 insertions, 0 deletions