diff options
| author | Peter Maydell <peter.maydell@linaro.org> | 2014-06-23 12:40:39 +0100 |
|---|---|---|
| committer | Peter Maydell <peter.maydell@linaro.org> | 2014-06-23 12:40:39 +0100 |
| commit | 910f66fcda2d410249697d959dcbdf8c82d77844 (patch) | |
| tree | 31488b416eb309f17ff9003f8d2a552e9045b7a3 | |
| parent | 337b172bb970bb4f679bfbd9a9a749d210511817 (diff) | |
| parent | 68716da745858ca86ac587d14ac553051e5f04eb (diff) | |
| download | qemu-910f66fcda2d410249697d959dcbdf8c82d77844.tar.gz | |
Merge remote-tracking branch 'remotes/mcayland/qemu-sparc' into staging
* remotes/mcayland/qemu-sparc:
apb: Fix out-of-bounds array write access
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| -rw-r--r-- | hw/pci-host/apb.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/hw/pci-host/apb.c b/hw/pci-host/apb.c index 6fa2723449..d238a84f95 100644 --- a/hw/pci-host/apb.c +++ b/hw/pci-host/apb.c @@ -333,7 +333,7 @@ static void iommu_config_write(void *opaque, hwaddr addr, is->regs[IOMMU_CTRL >> 3] &= 0xffffffffULL; is->regs[IOMMU_CTRL >> 3] |= val << 32; } else { - is->regs[IOMMU_CTRL] = val; + is->regs[IOMMU_CTRL >> 3] = val; } break; case IOMMU_CTRL + 0x4: @@ -345,7 +345,7 @@ static void iommu_config_write(void *opaque, hwaddr addr, is->regs[IOMMU_BASE >> 3] &= 0xffffffffULL; is->regs[IOMMU_BASE >> 3] |= val << 32; } else { - is->regs[IOMMU_BASE] = val; + is->regs[IOMMU_BASE >> 3] = val; } break; case IOMMU_BASE + 0x4: |