motorhead/qemu
1
0
Fork 0
mirror of https://github.com/Motorhead1991/qemu.git synced 2026-01-04 05:30:31 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions
qemu/hw
History
Exact
Jamin Lin 88f98ad83a hw/misc/aspeed_hace: Fix buffer overflow in has_padding function 
The maximum padding size is either 64 or 128 bytes and should always be smaller
than "req_len". If "padding_size" exceeds "req_len", then
"req_len - padding_size" underflows due to "uint32_t" data type, leading to a
large incorrect value (e.g., `0xFFXXXXXX`). This causes an out-of-bounds memory
access, potentially leading to a buffer overflow.

Added a check to ensure "padding_size" does not exceed "req_len" before
computing "pad_offset". This prevents "req_len - padding_size" from underflowing
and avoids accessing invalid memory.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Fixes: 5cd7d8564a ("aspeed/hace: Support AST2600 HACE ")
Link: https://lore.kernel.org/qemu-devel/20250321092623.2097234-3-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
(cherry picked from commit 78877b2e06)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2025-03-24 23:50:03 +03:00
..
9pfs 9pfs: fix 'Tgetattr' after unlink 2024-12-03 09:22:01 +03:00
acpi hmat acpi: Fix out of bounds access due to missing use of indirection 2024-03-14 21:24:34 +03:00
adc hw/adc: Make adci[*] R/W in NPCM7XX ADC 2022-07-18 13:20:14 +01:00
alpha hw: Remove unused MAX_IDE_BUS define 2022-10-31 11:32:07 +01:00
arm Kconfig: Extract CONFIG_USB_CHIPIDEA from CONFIG_IMX 2025-03-22 10:52:25 +03:00
audio hw/audio/hda: fix memory leak on audio setup 2024-11-18 19:30:13 +03:00
avr Remove qemu-common.h include from most units 2022-04-06 14:31:55 +02:00
block hw/block/nand: Fix out-of-bound access in NAND block buffer 2024-04-10 19:36:00 +03:00
char hw/char/bcm2835_aux: Fix assert when receive FIFO fills up 2024-08-02 09:37:28 +03:00
core qdev: Fix set_pci_devfn() to visit option only once 2024-11-26 19:06:00 +03:00
cpu cpu/core: Fix "help" of CPU core device types 2021-04-09 16:05:16 -04:00
cris Do not include exec/address-spaces.h if it's not really necessary 2021-05-02 17:24:51 +02:00
cxl hw/cxl/cxl-host: Fix segmentation fault when getting cxl-fmw property 2024-07-24 07:31:14 +03:00
display hw/display/vhost-user-gpu.c: fix vhost_user_gpu_chr_read() 2024-09-12 09:20:33 +03:00
dma hw/dmax/xlnx_dpdma: fix handling of address_extension descriptor fields 2024-05-02 13:16:29 +03:00
gpio hw/gpio: npcm7xx: fixup out-of-bounds access 2025-03-22 10:52:25 +03:00
hppa target/hppa: Provide qemu version via fw_cfg to firmware 2023-06-26 19:35:29 +03:00
hyperv hw/hyperv/hyperv.c: Use device_cold_reset() instead of device_legacy_reset() 2022-10-27 10:27:23 +01:00
i2c hw/i2c/aspeed: Fix TXBUF transmission start position error 2023-09-11 10:53:51 +03:00
i386 amd_iommu: Use correct bitmask to set capability BAR 2025-03-22 10:52:25 +03:00
ide hw/ide/ahci: fix legacy software reset 2023-11-22 14:25:06 +03:00
input lasips2: LASI PS/2 devices are not user-createable 2023-10-21 14:05:14 +03:00
intc hw/intc/arm_gicv3_cpuif: Don't downgrade monitor traps for AArch32 EL3 2025-03-22 10:52:25 +03:00
ipack qbus: Rename qbus_create_inplace() to qbus_init() 2021-09-30 13:42:10 +01:00
ipmi ipmi:smbus: Add a check around a memcpy 2022-08-01 06:40:50 -05:00
isa acpi: x86: move RPQx field back to _SB scope 2022-11-22 05:19:00 -05:00
loongarch Revert "hw/loongarch/virt: Add cfi01 pflash device" 2022-12-05 11:24:35 -05:00
m68k m68k/q800: do not re-randomize RNG seed on snapshot load 2022-10-27 11:34:31 +01:00
mem hw/mem/cxl-type3: Add CXL CDAT Data Object Exchange 2022-11-07 13:12:19 -05:00
microblaze hw/microblaze: pass random seed to fdt 2022-09-21 19:59:56 +02:00
mips hw/mips/malta: Fix the malta machine on big endian hosts 2023-12-20 19:11:10 +03:00
misc hw/misc/aspeed_hace: Fix buffer overflow in has_padding function 2025-03-24 23:50:03 +03:00
net hw/net/smc91c111: Don't allow data register access to overrun buffer 2025-03-22 10:52:25 +03:00
nios2 hw/nios2: set machine->fdt in nios2_load_dtb() 2022-10-17 16:15:10 -03:00
nubus qbus: Rename qbus_create_inplace() to qbus_init() 2021-09-30 13:42:10 +01:00
nvme hw/nvme: fix handling of over-committed queues 2024-11-10 11:10:00 +03:00
nvram hw/nvram/xlnx-efuse-ctrl: Free XlnxVersalEFuseCtrl[] "pg0-lock" array 2023-12-20 19:11:10 +03:00
openrisc hw/openrisc/openrisc_sim: keep serial@90000000 as default 2024-12-03 20:53:49 +03:00
pci pci/msix: Fix msix pba read vector poll end calculation 2025-01-17 09:26:23 +03:00
pci-bridge hw/pci-bridge/cxl-upstream: Add a CDAT table access DOE 2022-11-07 13:12:19 -05:00
pci-host pci-host: designware: Limit value range of iATU viewport register 2024-02-03 16:45:54 +03:00
pcmcia hw/pcmcia: Do not register PCMCIA type if not required 2021-05-02 17:24:50 +02:00
ppc ppc/pnv/occ: Fix common area sensor offsets 2025-03-22 10:52:25 +03:00
rdma hw/pvrdma: Protect against buggy or malicious guest driver 2023-10-21 14:05:14 +03:00
remote hw/remote/vfio-user: Fix config space access byte order 2024-05-10 13:20:20 +03:00
riscv hw/riscv: virt: Fix riscv,pmu DT node path 2023-09-13 12:21:22 +03:00
rtc goldfish_rtc: Fix tick_offset migration 2025-03-22 10:52:25 +03:00
rx rx: re-randomize rng-seed on reboot 2022-10-27 11:34:31 +01:00
s390x s390x/s390-virtio-ccw: don't crash on weird RAM sizes 2024-12-24 15:31:54 +03:00
scsi scsi: megasas: Internal cdbs have 16-byte length 2024-12-03 09:22:01 +03:00
sd hw/sd/sdhci: Reset @data_count index on invalid ADMA transfers 2024-08-11 10:43:25 +03:00
sensor hw/sensor: Add Renesas ISL69259 device model 2022-07-14 16:24:38 +02:00
sh4 Use g_new() & friends where that makes obvious sense 2022-03-21 15:44:44 +01:00
smbios hw/smbios: Fix port connector option validation 2024-02-13 21:06:28 +03:00
sparc machine: make memory-backend a link property 2022-05-12 12:29:44 +02:00
sparc64 hw: Remove unused MAX_IDE_BUS define 2022-10-31 11:32:07 +01:00
ssi aspeed/smc: Cache AspeedSMCClass 2022-10-24 11:20:15 +02:00
timer hw/timer/nrf51_timer: Don't lose time when timer is queried in tight loop 2023-06-22 10:38:38 +03:00
tpm hw/tpm: TIS on sysbus: Remove unsupport ppi command line option 2023-09-13 12:21:22 +03:00
tricore hw/tricore: fix inclusion of tricore_testboard 2021-07-20 20:10:21 +02:00
usb Kconfig: Extract CONFIG_USB_CHIPIDEA from CONFIG_IMX 2025-03-22 10:52:25 +03:00
vfio vfio/pci: Disable INTx in vfio_realize error path 2023-08-05 08:39:54 +03:00
virtio vdpa: Fix endian bugs in shadow virtqueue 2025-03-22 10:52:25 +03:00
watchdog watchdog: remove -watchdog option 2022-09-29 11:40:28 +02:00
xen xen/pt: reserve PCI slot 2 for Intel igd-passthru 2023-05-18 21:09:59 +03:00
xenpv Warn user if the vga flag is passed but no vga device is created 2022-05-09 08:21:14 +02:00
xtensa hw/xtensa: fix reset value of MIROUT register of MX PIC 2022-05-06 15:27:40 -07:00
Kconfig hw/loongarch: Add support loongson3 virt machine type. 2022-06-06 18:09:03 +00:00
meson.build hw/loongarch: Add support loongson3 virt machine type. 2022-06-06 18:09:03 +00:00