Commit 04bf2526 authored by Prasad J Pandit's avatar Prasad J Pandit Committed by Paolo Bonzini
Browse files

exec: use qemu_ram_ptr_length to access guest ram 



When accessing guest's ram block during DMA operation, use
'qemu_ram_ptr_length' to get ram block pointer. It ensures
that DMA operation of given length is possible; And avoids
any OOB memory access situations.

Reported-by: default avatarAlex <broscutamaker@gmail.com>
Signed-off-by: default avatarPrasad J Pandit <pjp@fedoraproject.org>
Message-Id: <20170712123840.29328-1-ppandit@redhat.com>
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
parent 1a29cc8f

exec.c

+2 −2
Original line number Diff line number Diff line
@@ -2929,7 +2929,7 @@ static MemTxResult address_space_write_continue(AddressSpace *as, hwaddr addr, 
            }

        } else {

            /* RAM case */

            ptr = qemu_map_ram_ptr(mr->ram_block, addr1);

            ptr = qemu_ram_ptr_length(mr->ram_block, addr1, &l);

            memcpy(ptr, buf, l);

            invalidate_and_set_dirty(mr, addr1, l);

        }
@@ -3020,7 +3020,7 @@ MemTxResult address_space_read_continue(AddressSpace *as, hwaddr addr, 
            }

        } else {

            /* RAM case */

            ptr = qemu_map_ram_ptr(mr->ram_block, addr1);

            ptr = qemu_ram_ptr_length(mr->ram_block, addr1, &l);

            memcpy(buf, ptr, l);

        }