[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH 32/43] vt82c686: avoid out-of-bounds read
From: |
Michael Roth |
Subject: |
[Qemu-devel] [PATCH 32/43] vt82c686: avoid out-of-bounds read |
Date: |
Tue, 24 Feb 2015 15:48:07 -0600 |
From: Paolo Bonzini <address@hidden>
superio_ioport_readb can read the 256th element of the array.
Coverity reports an out-of-bounds write in superio_ioport_writeb,
but it does not show the corresponding out-of-bounds read
because it cannot prove that it can happen. Fix the root
cause of the problem (zhanghailang's patch instead fixes
the logic in superio_ioport_writeb).
Signed-off-by: Paolo Bonzini <address@hidden>
Reviewed-by: zhanghailiang <address@hidden>
Signed-off-by: Michael Tokarev <address@hidden>
Cc: address@hidden
(cherry picked from commit 9feb8adeaa850d15b930c30f22c1ed2f2f695172)
Signed-off-by: Michael Roth <address@hidden>
---
hw/isa/vt82c686.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/hw/isa/vt82c686.c b/hw/isa/vt82c686.c
index e0c235c..a43e26d 100644
--- a/hw/isa/vt82c686.c
+++ b/hw/isa/vt82c686.c
@@ -36,7 +36,7 @@
typedef struct SuperIOConfig
{
- uint8_t config[0xff];
+ uint8_t config[0x100];
uint8_t index;
uint8_t data;
} SuperIOConfig;
--
1.9.1
- [Qemu-devel] [PATCH 21/43] target-xtensa: test cross-page opcode, (continued)
- [Qemu-devel] [PATCH 21/43] target-xtensa: test cross-page opcode, Michael Roth, 2015/02/24
- [Qemu-devel] [PATCH 26/43] serial: reset thri_pending on IER writes with THRI=0, Michael Roth, 2015/02/24
- [Qemu-devel] [PATCH 23/43] atomic: fix position of volatile qualifier, Michael Roth, 2015/02/24
- [Qemu-devel] [PATCH 22/43] migration/block: fix pending() return value, Michael Roth, 2015/02/24
- [Qemu-devel] [PATCH 15/43] qcow2: Fix header extension size check, Michael Roth, 2015/02/24
- [Qemu-devel] [PATCH 20/43] target-xtensa: fix translation for opcodes crossing page boundary, Michael Roth, 2015/02/24
- [Qemu-devel] [PATCH 29/43] linux-user: Fix broken m68k signal handling on 64 bit hosts, Michael Roth, 2015/02/24
- [Qemu-devel] [PATCH 27/43] serial: refine serial_thr_ipending_needed, Michael Roth, 2015/02/24
- [Qemu-devel] [PATCH 28/43] pckbd: set bits 2-3-6-7 of the output port by default, Michael Roth, 2015/02/24
- [Qemu-devel] [PATCH 33/43] virtio: fix feature bit checks, Michael Roth, 2015/02/24
- [Qemu-devel] [PATCH 32/43] vt82c686: avoid out-of-bounds read,
Michael Roth <=
- [Qemu-devel] [PATCH 31/43] target-i386: fix movntsd on big-endian hosts, Michael Roth, 2015/02/24
- [Qemu-devel] [PATCH 30/43] scsi: fix cancellation when I/O was completed but DMA was not., Michael Roth, 2015/02/24
- [Qemu-devel] [PATCH 02/43] block: Omit bdrv_find_format for essential drivers, Michael Roth, 2015/02/24
- [Qemu-devel] [PATCH 36/43] target-arm/translate-a64: Fix wrong mmu_idx usage for LDT/STT, Michael Roth, 2015/02/24
- [Qemu-devel] [PATCH 34/43] sb16: fix interrupt acknowledgement, Michael Roth, 2015/02/24
- [Qemu-devel] [PATCH 35/43] hw/input/hid.c Fix capslock hid code, Michael Roth, 2015/02/24
- [Qemu-devel] [PATCH 39/43] libcacard: stop linking against every single 3rd party library, Michael Roth, 2015/02/24
- [Qemu-devel] [PATCH 37/43] vfio-pci: Fix missing unparent of dynamically allocated MemoryRegion, Michael Roth, 2015/02/24
- [Qemu-devel] [PATCH 38/43] qemu-thread: fix qemu_event without futexes, Michael Roth, 2015/02/24
- [Qemu-devel] [PATCH 40/43] fix mc146818rtc wrong subsection name to avoid vmstate_subsection_load() fail, Michael Roth, 2015/02/24