[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 13/15] sd: limit 'req.cmd' while using as an array in
From: |
Peter Maydell |
Subject: |
[Qemu-devel] [PULL 13/15] sd: limit 'req.cmd' while using as an array index |
Date: |
Tue, 9 Feb 2016 18:43:03 +0000 |
From: Prasad J Pandit <address@hidden>
While processing standard SD commands, the 'req.cmd' value could
lead to OOB read when used as an index into 'sd_cmd_type' or
'sd_cmd_class' arrays. Limit 'req.cmd' value to avoid such an
access.
Reported-by: Qinghao Tang <address@hidden>
Signed-off-by: Prasad J Pandit <address@hidden>
Reviewed-by: Peter Maydell <address@hidden>
Message-id: address@hidden
Signed-off-by: Peter Maydell <address@hidden>
---
hw/sd/sd.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index 7580449..dd614b0 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -669,8 +669,10 @@ static sd_rsp_type_t sd_normal_command(SDState *sd,
/* Not interpreting this as an app command */
sd->card_status &= ~APP_CMD;
- if (sd_cmd_type[req.cmd] == sd_ac || sd_cmd_type[req.cmd] == sd_adtc)
+ if (sd_cmd_type[req.cmd & 0x3F] == sd_ac
+ || sd_cmd_type[req.cmd & 0x3F] == sd_adtc) {
rca = req.arg >> 16;
+ }
DPRINTF("CMD%d 0x%08x state %d\n", req.cmd, req.arg, sd->state);
switch (req.cmd) {
@@ -1341,7 +1343,8 @@ static int cmd_valid_while_locked(SDState *sd, SDRequest
*req)
if (req->cmd == 16 || req->cmd == 55) {
return 1;
}
- return sd_cmd_class[req->cmd] == 0 || sd_cmd_class[req->cmd] == 7;
+ return sd_cmd_class[req->cmd & 0x3F] == 0
+ || sd_cmd_class[req->cmd & 0x3F] == 7;
}
int sd_do_command(SDState *sd, SDRequest *req,
--
1.9.1
- [Qemu-devel] [PULL 00/15] target-arm queue, Peter Maydell, 2016/02/09
- [Qemu-devel] [PULL 13/15] sd: limit 'req.cmd' while using as an array index,
Peter Maydell <=
- [Qemu-devel] [PULL 14/15] hw/arm/virt: fix max-cpus check, Peter Maydell, 2016/02/09
- [Qemu-devel] [PULL 15/15] bcm2835_property: implement "get board revision" query, Peter Maydell, 2016/02/09
- [Qemu-devel] [PULL 09/15] target-arm: Fix IL bit reported for Thumb coprocessor traps, Peter Maydell, 2016/02/09
- [Qemu-devel] [PULL 10/15] target-arm: Fix IL bit reported for Thumb VFP and Neon traps, Peter Maydell, 2016/02/09
- [Qemu-devel] [PULL 03/15] target-arm: Use access_trap_aa32s_el1() for SCR and MVBAR, Peter Maydell, 2016/02/09
- [Qemu-devel] [PULL 07/15] target-arm: Enable EL3 for Cortex-A53 and Cortex-A57, Peter Maydell, 2016/02/09
- [Qemu-devel] [PULL 12/15] target-arm: Implement checking of fired watchpoint, Peter Maydell, 2016/02/09
- [Qemu-devel] [PULL 11/15] cpu: Add callback to check architectural watchpoint match, Peter Maydell, 2016/02/09
- [Qemu-devel] [PULL 08/15] target-arm: Correct misleading 'is_thumb' syn_* parameter names, Peter Maydell, 2016/02/09
- [Qemu-devel] [PULL 02/15] target-arm: Implement MDCR_EL3 and SDCR, Peter Maydell, 2016/02/09