From 6982d6647ea98544f76d5ef40ddc23115ff44a77 Mon Sep 17 00:00:00 2001 From: Jan Kiszka Date: Sun, 13 Jun 2010 14:15:34 +0200 Subject: [PATCH] hpet: Catch out-of-bounds timer access Also prevent out-of-bounds write access to the timers but don't spam the host console if it triggers. Signed-off-by: Jan Kiszka Signed-off-by: Blue Swirl --- hw/hpet.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/hw/hpet.c b/hw/hpet.c index 8729fb21c6..198090643e 100644 --- a/hw/hpet.c +++ b/hw/hpet.c @@ -294,7 +294,7 @@ static uint32_t hpet_ram_readl(void *opaque, target_phys_addr_t addr) if (index >= 0x100 && index <= 0x3ff) { uint8_t timer_id = (addr - 0x100) / 0x20; if (timer_id > HPET_NUM_TIMERS - 1) { - printf("qemu: timer id out of range\n"); + DPRINTF("qemu: timer id out of range\n"); return 0; } HPETTimer *timer = &s->timer[timer_id]; @@ -383,6 +383,10 @@ static void hpet_ram_writel(void *opaque, target_phys_addr_t addr, DPRINTF("qemu: hpet_ram_writel timer_id = %#x \n", timer_id); HPETTimer *timer = &s->timer[timer_id]; + if (timer_id > HPET_NUM_TIMERS - 1) { + DPRINTF("qemu: timer id out of range\n"); + return; + } switch ((addr - 0x100) % 0x20) { case HPET_TN_CFG: DPRINTF("qemu: hpet_ram_writel HPET_TN_CFG\n"); -- 2.11.4.GIT