From c46a3ea025b147d58e4c7a222307ccba1e9e376f Mon Sep 17 00:00:00 2001 From: Blue Swirl Date: Wed, 12 Jan 2011 21:00:01 +0000 Subject: lan9118: fix a buffer overflow Fix a buffer overflow, reported by cppcheck: [/src/qemu/hw/lan9118.c:849]: (error) Buffer access out-of-bounds: s.eeprom All eeprom handling code assumes that the size of eeprom is 128, except lan9118_eeprom_cmd. Fix this by restricting the address passed. Signed-off-by: Blue Swirl --- hw/lan9118.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'hw/lan9118.c') diff --git a/hw/lan9118.c b/hw/lan9118.c index a98866479b..9cc7952b2a 100644 --- a/hw/lan9118.c +++ b/hw/lan9118.c @@ -187,7 +187,7 @@ typedef struct { uint32_t phy_int_mask; int eeprom_writable; - uint8_t eeprom[8]; + uint8_t eeprom[128]; int tx_fifo_size; LAN9118Packet *txp; @@ -1003,7 +1003,7 @@ static void lan9118_writel(void *opaque, target_phys_addr_t offset, s->afc_cfg = val & 0x00ffffff; break; case CSR_E2P_CMD: - lan9118_eeprom_cmd(s, (val >> 28) & 7, val & 0xff); + lan9118_eeprom_cmd(s, (val >> 28) & 7, val & 0x7f); break; case CSR_E2P_DATA: s->e2p_data = val & 0xff; -- cgit v1.2.1