[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Qemu-devel] [PATCH] tpm_tis: validate locality values don't overrun

From: Stefan Berger
Subject: Re: [Qemu-devel] [PATCH] tpm_tis: validate locality values don't overrun array
Date: Fri, 8 Feb 2019 16:29:16 -0500
User-agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.3.1

On 2/8/19 3:38 PM, Stefan Berger wrote:
On 2/8/19 3:10 PM, Liam Merwick wrote:

From staring at the code, I do have one other question - why does the check of the lower localities below only check 'l < locty - 1' before setting s->loc[locty] - it seems like s->loc[locty - 1] is skipped.

 627                 /* cancel any seize by a lower locality */
 628                 for (l = 0; l < locty - 1; l++) {
 629                     s->loc[l].access &= ~TPM_TIS_ACCESS_SEIZE;
 630                 }

Uuuh. The loop is clearing the SEIZE flag on localities lower than the current one. This works fine for locty >= 1, but not for locty = 0. I think there's a bug here.

Actually, the compiler is smarter than that. With locty = 0, and l = 0,  l < locty - 1 evaluates to 'false' and the loop doesn't get executed! Lucky me.


reply via email to

[Prev in Thread] Current Thread [Next in Thread]