diff options
| author | Paolo Bonzini <pbonzini@redhat.com> | 2016-07-04 13:06:37 +0100 |
|---|---|---|
| committer | Peter Maydell <peter.maydell@linaro.org> | 2016-07-04 13:15:22 +0100 |
| commit | b68cb06093a36bd6fbd4d06cd62c08629fea2242 (patch) | |
| tree | 0174660ddc51301f91226784843eeaf9678cfe55 /qobject/json-parser.c | |
| parent | cace7b801d49430522840fa13e9ac2bdc2dcf941 (diff) | |
| download | focaccia-qemu-b68cb06093a36bd6fbd4d06cd62c08629fea2242.tar.gz focaccia-qemu-b68cb06093a36bd6fbd4d06cd62c08629fea2242.zip | |
m25p80: avoid out of bounds accesses
s->cur_addr can be made to point outside s->storage, either by writing a value >= 128 to s->ear (because s->ear * MAX_3BYTES_SIZE is a signed integer and sign-extends into the 64-bit cur_addr), or just by writing an address beyond the size of the flash being emulated. Avoid the sign extension to make the code cleaner, and on top of that mask s->cur_addr to s->size. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-id: 1467138270-32481-4-git-send-email-clg@kaod.org Reviewed by: Marcin Krzeminski <marcin.krzeminski@nokia.com> Signed-off-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Diffstat (limited to 'qobject/json-parser.c')
0 files changed, 0 insertions, 0 deletions