diff options
| author | Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> | 2014-05-24 11:51:50 +0100 |
|---|---|---|
| committer | Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> | 2014-06-05 20:51:30 +0100 |
| commit | 366d4f7e0007a5540897fbac6e377c57d8c79a73 (patch) | |
| tree | 413fb8f72f65ac9521a570c35347a6c50530593d /hw/display/tcx.c | |
| parent | e09c49f40de32620e99f67a71d4508c7fe97dd84 (diff) | |
| download | qemu-366d4f7e0007a5540897fbac6e377c57d8c79a73.tar.gz qemu-366d4f7e0007a5540897fbac6e377c57d8c79a73.tar.bz2 qemu-366d4f7e0007a5540897fbac6e377c57d8c79a73.zip | |
cg3: add extra check to prevent CG3 register array overflow
The case statements in the CG3 read and write register routines have a maximum
value of CG3_REG_SIZE, so if a value were written to this offset then it
would overflow the register array.
Currently this cannot be exploited since the MemoryRegion restricts accesses
to the range 0 ... CG3_REG_SIZE - 1, but it seems worth clarifying this for
future review and/or static analysis.
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
CC: Paolo Bonzini <pbonzini@redhat.com>
Diffstat (limited to 'hw/display/tcx.c')
0 files changed, 0 insertions, 0 deletions