mirror of
https://github.com/Motorhead1991/qemu.git
synced 2025-12-24 00:18:36 -07:00
0c249ff71c
Some address/memory APIs have different type between
'hwaddr/target_ulong addr' and 'int len'. It is very unsafe, especially
some APIs will be passed a non-int len by caller which might cause
overflow quietly.
Below is an potential overflow case:
dma_memory_read(uint32_t len)
-> dma_memory_rw(uint32_t len)
-> dma_memory_rw_relaxed(uint32_t len)
-> address_space_rw(int len) # len overflow
CC: Paolo Bonzini <pbonzini@redhat.com>
CC: Peter Crosthwaite <crosthwaite.peter@gmail.com>
CC: Richard Henderson <rth@twiddle.net>
CC: Peter Maydell <peter.maydell@linaro.org>
CC: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: Li Zhijian <lizhijian@cn.fujitsu.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
|
||
|---|---|---|
| .. | ||
| user | ||
| address-spaces.h | ||
| cpu-all.h | ||
| cpu-common.h | ||
| cpu-defs.h | ||
| cpu_ldst.h | ||
| cpu_ldst_template.h | ||
| cpu_ldst_useronly_template.h | ||
| cputlb.h | ||
| exec-all.h | ||
| gdbstub.h | ||
| gen-icount.h | ||
| helper-gen.h | ||
| helper-head.h | ||
| helper-proto.h | ||
| helper-tcg.h | ||
| hwaddr.h | ||
| ioport.h | ||
| log.h | ||
| memattrs.h | ||
| memory-internal.h | ||
| memory.h | ||
| memory_ldst.inc.h | ||
| memory_ldst_cached.inc.h | ||
| memory_ldst_phys.inc.h | ||
| poison.h | ||
| ram_addr.h | ||
| ramlist.h | ||
| semihost.h | ||
| softmmu-semi.h | ||
| target_page.h | ||
| tb-context.h | ||
| tb-hash.h | ||
| tb-lookup.h | ||
| translator.h | ||