aboutsummaryrefslogtreecommitdiff
path: root/tests/qtest/meson.build
diff options
context:
space:
mode:
authorQiang Liu <cyruscyliu@gmail.com>2021-08-04 14:51:50 +0800
committerGerd Hoffmann <kraxel@redhat.com>2021-08-31 14:34:36 +0200
commit2b3a98255c90d8d2f9f87a73eb33371961508517 (patch)
tree6bc9c3a868a27fbbb6480fd3ad66c3465773f207 /tests/qtest/meson.build
parent7852a77f598635a67a222b6c1463c8b46098aed2 (diff)
hw/display/xlnx_dp: fix an out-of-bounds read in xlnx_dp_read
xlnx_dp_read allows an out-of-bounds read at its default branch because of an improper index. According to https://www.xilinx.com/html_docs/registers/ug1087/ug1087-zynq-ultrascale-registers.html (DP Module), registers 0x3A4/0x3A4/0x3AC are allowed. DP_INT_MASK 0x000003A4 32 mixed 0xFFFFF03F Interrupt Mask Register for intrN. DP_INT_EN 0x000003A8 32 mixed 0x00000000 Interrupt Enable Register. DP_INT_DS 0x000003AC 32 mixed 0x00000000 Interrupt Disable Register. In xlnx_dp_write, when the offset is 0x3A8 and 0x3AC, the virtual device will write s->core_registers[0x3A4 >> 2]. That is to say, the maxize of s->core_registers could be ((0x3A4 >> 2) + 1). However, the current size of s->core_registers is (0x3AF >> >> 2), that is ((0x3A4 >> 2) + 2), which is out of the range. In xlxn_dp_read, the access to offset 0x3A8 or 0x3AC will be directed to the offset 0x3A8 (incorrect functionality) or 0x3AC (out-of-bounds read) rather than 0x3A4. This patch enforces the read access to offset 0x3A8 and 0x3AC to 0x3A4, but does not adjust the size of s->core_registers to avoid breaking migration. Fixes: 58ac482a66de ("introduce xlnx-dp") Signed-off-by: Qiang Liu <cyruscyliu@gmail.com> Acked-by: Thomas Huth <thuth@redhat.com> Acked-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <1628059910-12060-1-git-send-email-cyruscyliu@gmail.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Diffstat (limited to 'tests/qtest/meson.build')
-rw-r--r--tests/qtest/meson.build1
1 files changed, 1 insertions, 0 deletions
diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
index 2bc3efd49f..757bb8499a 100644
--- a/tests/qtest/meson.build
+++ b/tests/qtest/meson.build
@@ -187,6 +187,7 @@ qtests_aarch64 = \
'numa-test',
'boot-serial-test',
'xlnx-can-test',
+ 'fuzz-xlnx-dp-test',
'migration-test']
qtests_s390x = \