| commit | d6c3768b32277559cf6424bdf1edfee1fbf9a970 | |
| author | Prasad J Pandit <pjp@fedoraproject.org> | |
| Wed, 13 Dec 2017 17:59:26 +0000 (13 17:59 +0000) | ||
| committer | Peter Maydell <peter.maydell@linaro.org> | |
| Wed, 13 Dec 2017 17:59:26 +0000 (13 17:59 +0000) | ||
| tree | 4212eac44deda01b594a75622fb19f8f6f714cfb | treesnapshot (tar.gz zip) |
| parent | 27f26bfed923e4c68a1acb61fdafcd0bc63abf71 | commitdiff |
hw/display/tc6393xb: limit irq handler index to TC6393XB_GPIOS
The ctz32() routine could return a value greater than
TC6393XB_GPIOS=16, because the device has 24 GPIO level
bits but we only implement 16 outgoing lines. This could
lead to an OOB array access. Mask 'level' to avoid it.
Reported-by: Moguofang <moguofang@huawei.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Message-id: 20171212041539.25700-1-ppandit@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
The ctz32() routine could return a value greater than
TC6393XB_GPIOS=16, because the device has 24 GPIO level
bits but we only implement 16 outgoing lines. This could
lead to an OOB array access. Mask 'level' to avoid it.
Reported-by: Moguofang <moguofang@huawei.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Message-id: 20171212041539.25700-1-ppandit@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| hw/display/tc6393xb.c | diffblobblamehistory |