diff options
| author | Peter Maydell <peter.maydell@linaro.org> | 2018-11-19 15:29:08 +0000 |
|---|---|---|
| committer | Peter Maydell <peter.maydell@linaro.org> | 2018-11-19 15:55:11 +0000 |
| commit | fcf5787c02f7f9ff9f314161631c347d6b69b904 (patch) | |
| tree | 28ad937c82e43539311e15f0994884509c67f86e | |
| parent | 7760da729ac88f112f98f36395ac3b55fc9e4211 (diff) | |
| download | qemu-fcf5787c02f7f9ff9f314161631c347d6b69b904.zip | |
hw/block/onenand: Fix off-by-one error allowing out-of-bounds read
An off-by-one error in a switch case in onenand_read() allowed
a misbehaving guest to read off the end of a block of memory.
NB: the onenand device is used only by the "n800" and "n810"
machines, which are usable only with TCG, not KVM, so this is
not a security issue.
Reported-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20181115143535.5885-2-peter.maydell@linaro.org
Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| -rw-r--r-- | hw/block/onenand.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/hw/block/onenand.c b/hw/block/onenand.c index 0cb8d7fa13..49ef68c9b1 100644 --- a/hw/block/onenand.c +++ b/hw/block/onenand.c @@ -608,7 +608,7 @@ static uint64_t onenand_read(void *opaque, hwaddr addr, int offset = addr >> s->shift; switch (offset) { - case 0x0000 ... 0xc000: + case 0x0000 ... 0xbffe: return lduw_le_p(s->boot[0] + addr); case 0xf000: /* Manufacturer ID */ |