diff options
| author | Prasad J Pandit <pjp@fedoraproject.org> | 2017-12-13 17:59:26 +0000 |
|---|---|---|
| committer | Peter Maydell <peter.maydell@linaro.org> | 2017-12-13 17:59:26 +0000 |
| commit | d6c3768b32277559cf6424bdf1edfee1fbf9a970 (patch) | |
| tree | 4212eac44deda01b594a75622fb19f8f6f714cfb /hw/display | |
| parent | 27f26bfed923e4c68a1acb61fdafcd0bc63abf71 (diff) | |
| download | qemu-d6c3768b32277559cf6424bdf1edfee1fbf9a970.tar.gz | |
hw/display/tc6393xb: limit irq handler index to TC6393XB_GPIOS
The ctz32() routine could return a value greater than
TC6393XB_GPIOS=16, because the device has 24 GPIO level
bits but we only implement 16 outgoing lines. This could
lead to an OOB array access. Mask 'level' to avoid it.
Reported-by: Moguofang <moguofang@huawei.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Message-id: 20171212041539.25700-1-ppandit@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Diffstat (limited to 'hw/display')
| -rw-r--r-- | hw/display/tc6393xb.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/hw/display/tc6393xb.c b/hw/display/tc6393xb.c index 74d10af3d4..0ae63605f0 100644 --- a/hw/display/tc6393xb.c +++ b/hw/display/tc6393xb.c @@ -172,6 +172,7 @@ static void tc6393xb_gpio_handler_update(TC6393xbState *s) int bit; level = s->gpio_level & s->gpio_dir; + level &= MAKE_64BIT_MASK(0, TC6393XB_GPIOS); for (diff = s->prev_level ^ level; diff; diff ^= 1 << bit) { bit = ctz32(diff); |