mirror of
https://github.com/Motorhead1991/qemu.git
synced 2025-12-22 07:28:36 -07:00
According to cxl_interleave_ways_enc(), fw->num_targets is allowed to be up
to 16. This also corresponds to CXL r3.0 spec. So, the fw->target_hbs[]
array is iterated from 0 to 15. But it is statically declared of length 8.
Thus, out of bound array access may occur.
Fixes:
|
||
|---|---|---|
| .. | ||
| cxl.h | ||
| cxl_cdat.h | ||
| cxl_component.h | ||
| cxl_device.h | ||
| cxl_events.h | ||
| cxl_host.h | ||
| cxl_pci.h | ||