| commit | fcf5787c02f7f9ff9f314161631c347d6b69b904 | |
| author | Peter Maydell <peter.maydell@linaro.org> | |
| Mon, 19 Nov 2018 15:29:08 +0000 (19 15:29 +0000) | ||
| committer | Peter Maydell <peter.maydell@linaro.org> | |
| Mon, 19 Nov 2018 15:55:11 +0000 (19 15:55 +0000) | ||
| tree | 28ad937c82e43539311e15f0994884509c67f86e | treesnapshot (tar.gz zip) |
| parent | 7760da729ac88f112f98f36395ac3b55fc9e4211 | commitdiff |
hw/block/onenand: Fix off-by-one error allowing out-of-bounds read
An off-by-one error in a switch case in onenand_read() allowed
a misbehaving guest to read off the end of a block of memory.
NB: the onenand device is used only by the "n800" and "n810"
machines, which are usable only with TCG, not KVM, so this is
not a security issue.
Reported-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20181115143535.5885-2-peter.maydell@linaro.org
Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
An off-by-one error in a switch case in onenand_read() allowed
a misbehaving guest to read off the end of a block of memory.
NB: the onenand device is used only by the "n800" and "n810"
machines, which are usable only with TCG, not KVM, so this is
not a security issue.
Reported-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20181115143535.5885-2-peter.maydell@linaro.org
Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| hw/block/onenand.c | diffblobblamehistory |