diff options
| author | Paolo Bonzini <pbonzini@redhat.com> | 2016-07-04 13:06:37 +0100 |
|---|---|---|
| committer | Peter Maydell <peter.maydell@linaro.org> | 2016-07-04 13:15:22 +0100 |
| commit | b68cb06093a36bd6fbd4d06cd62c08629fea2242 (patch) | |
| tree | 0174660ddc51301f91226784843eeaf9678cfe55 /qapi-schema.json | |
| parent | cace7b801d49430522840fa13e9ac2bdc2dcf941 (diff) | |
| download | qemu-b68cb06093a36bd6fbd4d06cd62c08629fea2242.tar.gz qemu-b68cb06093a36bd6fbd4d06cd62c08629fea2242.tar.bz2 qemu-b68cb06093a36bd6fbd4d06cd62c08629fea2242.zip | |
m25p80: avoid out of bounds accesses
s->cur_addr can be made to point outside s->storage, either by
writing a value >= 128 to s->ear (because s->ear * MAX_3BYTES_SIZE
is a signed integer and sign-extends into the 64-bit cur_addr),
or just by writing an address beyond the size of the flash being
emulated. Avoid the sign extension to make the code cleaner, and
on top of that mask s->cur_addr to s->size.
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-id: 1467138270-32481-4-git-send-email-clg@kaod.org
Reviewed by: Marcin Krzeminski <marcin.krzeminski@nokia.com>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Diffstat (limited to 'qapi-schema.json')
0 files changed, 0 insertions, 0 deletions