motorhead/qemu
1
0
Fork 0
mirror of https://github.com/Motorhead1991/qemu.git synced 2025-08-02 15:23:53 -06:00
Code Issues Projects Releases Packages Wiki Activity Actions

qdev: Use int32_t container for devfn property

Browse source 
Valid range for devfn is -1 to 255 (-1 for automatic assignment). We do
not currently validate this due to devfn being stored as a uint32_t.
This can lead to segfaults and other strange behavior.

We could technically just cast it to int32_t to implement the checking,
but this will not work for visitor-based setting where we may do additional
bounds-checking based on target container type, which is int32_t for this
case.

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>
This commit is contained in:
Michael Roth 2012-03-04 13:38:27 -06:00 • committed by Andreas Färber
parent 0d30b0a2d3
commit 09f1bbcd83
4 changed files with 7 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

11
hw/qdev-properties.c
View file

@ -824,7 +824,7 @@ static void set_pci_devfn(Object *obj, Visitor *v, void *opaque,
{
DeviceState *dev = DEVICE(obj);
Property *prop = opaque;
uint32_t *ptr = qdev_get_prop_ptr(dev, prop);
int32_t *ptr = qdev_get_prop_ptr(dev, prop);
unsigned int slot, fn, n;
Error *local_err = NULL;
char *str;
@ -860,7 +860,7 @@ invalid:
static int print_pci_devfn(DeviceState *dev, Property *prop, char *dest, size_t len)
{
uint32_t *ptr = qdev_get_prop_ptr(dev, prop);
int32_t *ptr = qdev_get_prop_ptr(dev, prop);
if (*ptr == -1) {
return snprintf(dest, len, "<unset>");
@ -875,11 +875,8 @@ PropertyInfo qdev_prop_pci_devfn = {
.print = print_pci_devfn,
.get = get_int32,
.set = set_pci_devfn,
/* FIXME: this should be -1...255, but the address is stored
* into an uint32_t rather than int32_t.
*/
.min = 0,
.max = 0xFFFFFFFFULL,
.min = -1,
.max = 255,
};
/* --- blocksize --- */