diff options
| author | Prasad J Pandit <pjp@fedoraproject.org> | 2017-02-07 18:29:59 +0000 |
|---|---|---|
| committer | Michael Roth <mdroth@linux.vnet.ibm.com> | 2017-03-16 12:10:40 -0500 |
| commit | 1a156ae5d1fa2b8117e5e0a2bd73e21480df9bdb (patch) | |
| tree | 249a2983f183d97448814f01a1ea039944457b47 | |
| parent | 3b8f27fe0b9cd2f2603c45dd8cb720eed85b3f08 (diff) | |
| download | qemu-1a156ae5d1fa2b8117e5e0a2bd73e21480df9bdb.tar.gz | |
sd: sdhci: check data length during dma_memory_read
While doing multi block SDMA transfer in routine
'sdhci_sdma_transfer_multi_blocks', the 's->fifo_buffer' starting
index 'begin' and data length 's->data_count' could end up to be same.
This could lead to an OOB access issue. Correct transfer data length
to avoid it.
Cc: qemu-stable@nongnu.org
Reported-by: Jiang Xin <jiangxin1@huawei.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20170130064736.9236-1-ppandit@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
(cherry picked from commit 42922105beb14c2fc58185ea022b9f72fb5465e9)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
| -rw-r--r-- | hw/sd/sdhci.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c index 01fbf228be..5bd5ab6319 100644 --- a/hw/sd/sdhci.c +++ b/hw/sd/sdhci.c @@ -536,7 +536,7 @@ static void sdhci_sdma_transfer_multi_blocks(SDHCIState *s) boundary_count -= block_size - begin; } dma_memory_read(&address_space_memory, s->sdmasysad, - &s->fifo_buffer[begin], s->data_count); + &s->fifo_buffer[begin], s->data_count - begin); s->sdmasysad += s->data_count - begin; if (s->data_count == block_size) { for (n = 0; n < block_size; n++) { |