Commit 58d47978 authored by Peter Maydell's avatar Peter Maydell Committed by Leon Alrae
Browse files

hw/pci-host/bonito: Avoid buffer overrun for bad LDMA/COP accesses 



The LDMA and COP memory regions represent four 32 bit registers
each, but the memory regions themselves are 0x100 bytes large.
Add guards to the read and write accessors so that bogus accesses
beyond the four defined registers don't just run off the end of
the bonldma and boncop structs and into whatever lies beyond.

Signed-off-by: default avatarPeter Maydell <peter.maydell@linaro.org>
Acked-by: default avatarAurelien Jarno <aurelien@aurel32.net>
Signed-off-by: default avatarLeon Alrae <leon.alrae@imgtec.com>
parent eb02cc3f

hw/pci-host/bonito.c

+16 −0
Original line number Diff line number Diff line
@@ -355,6 +355,10 @@ static uint64_t bonito_ldma_readl(void *opaque, hwaddr addr, 
    uint32_t val;

    PCIBonitoState *s = opaque;



    if (addr >= sizeof(s->bonldma)) {

        return 0;

    }



    val = ((uint32_t *)(&s->bonldma))[addr/sizeof(uint32_t)];



    return val;
@@ -365,6 +369,10 @@ static void bonito_ldma_writel(void *opaque, hwaddr addr, 
{

    PCIBonitoState *s = opaque;



    if (addr >= sizeof(s->bonldma)) {

        return;

    }



    ((uint32_t *)(&s->bonldma))[addr/sizeof(uint32_t)] = val & 0xffffffff;

}
@@ -384,6 +392,10 @@ static uint64_t bonito_cop_readl(void *opaque, hwaddr addr, 
    uint32_t val;

    PCIBonitoState *s = opaque;



    if (addr >= sizeof(s->boncop)) {

        return 0;

    }



    val = ((uint32_t *)(&s->boncop))[addr/sizeof(uint32_t)];



    return val;
@@ -394,6 +406,10 @@ static void bonito_cop_writel(void *opaque, hwaddr addr, 
{

    PCIBonitoState *s = opaque;



    if (addr >= sizeof(s->boncop)) {

        return;

    }



    ((uint32_t *)(&s->boncop))[addr/sizeof(uint32_t)] = val & 0xffffffff;

}