| commit | 42922105beb14c2fc58185ea022b9f72fb5465e9 | |
| author | Prasad J Pandit <pjp@fedoraproject.org> | |
| Tue, 7 Feb 2017 18:29:59 +0000 (7 18:29 +0000) | ||
| committer | Peter Maydell <peter.maydell@linaro.org> | |
| Tue, 7 Feb 2017 18:29:59 +0000 (7 18:29 +0000) | ||
| tree | 3b115f72243dfbd716aa1d823bcde2ba30af0635 | treesnapshot (tar.gz zip) |
| parent | 013befe1ca055f555062c8ead083b3c214be97b1 | commitdiff |
sd: sdhci: check data length during dma_memory_read
While doing multi block SDMA transfer in routine
'sdhci_sdma_transfer_multi_blocks', the 's->fifo_buffer' starting
index 'begin' and data length 's->data_count' could end up to be same.
This could lead to an OOB access issue. Correct transfer data length
to avoid it.
Cc: qemu-stable@nongnu.org
Reported-by: Jiang Xin <jiangxin1@huawei.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20170130064736.9236-1-ppandit@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
While doing multi block SDMA transfer in routine
'sdhci_sdma_transfer_multi_blocks', the 's->fifo_buffer' starting
index 'begin' and data length 's->data_count' could end up to be same.
This could lead to an OOB access issue. Correct transfer data length
to avoid it.
Cc: qemu-stable@nongnu.org
Reported-by: Jiang Xin <jiangxin1@huawei.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20170130064736.9236-1-ppandit@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| hw/sd/sdhci.c | diffblobblamehistory |