[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH v4 07/14] hw/sd/sdcard: Check address is in range
From: |
Philippe Mathieu-Daudé |
Subject: |
[PATCH v4 07/14] hw/sd/sdcard: Check address is in range |
Date: |
Fri, 26 Jun 2020 18:28:11 +0200 |
As a defense, assert if the requested address is out of the card area.
Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
---
hw/sd/sd.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index 871c30a67f..0b606e9054 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -539,6 +539,8 @@ static void sd_response_r7_make(SDState *sd, uint8_t
*response)
static inline uint64_t sd_addr_to_wpnum(uint64_t addr)
{
+ assert(addr < sd->size);
+
return addr >> (HWBLOCK_SHIFT + SECTOR_SHIFT + WPGROUP_SHIFT);
}
--
2.21.3
- [PATCH v4 00/14] hw/sd/sdcard: Fix CVE-2020-13253 & cleanups, Philippe Mathieu-Daudé, 2020/06/26
- [PATCH v4 01/14] MAINTAINERS: Cc qemu-block mailing list, Philippe Mathieu-Daudé, 2020/06/26
- [PATCH v4 02/14] hw/sd/sdcard: Update coding style to make checkpatch.pl happy, Philippe Mathieu-Daudé, 2020/06/26
- [PATCH v4 03/14] hw/sd/sdcard: Move some definitions to use them earlier, Philippe Mathieu-Daudé, 2020/06/26
- [PATCH v4 04/14] hw/sd/sdcard: Use the HWBLOCK_SIZE definition, Philippe Mathieu-Daudé, 2020/06/26
- [PATCH v4 05/14] hw/sd/sdcard: Do not switch to ReceivingData if address is invalid, Philippe Mathieu-Daudé, 2020/06/26
- [PATCH v4 06/14] hw/sd/sdcard: Restrict Class 6 commands to SCSD cards, Philippe Mathieu-Daudé, 2020/06/26
- [PATCH v4 07/14] hw/sd/sdcard: Check address is in range,
Philippe Mathieu-Daudé <=
- [PATCH v4 08/14] hw/sd/sdcard: Update the SDState documentation, Philippe Mathieu-Daudé, 2020/06/26
- [PATCH v4 09/14] hw/sd/sdcard: Simplify cmd_valid_while_locked(), Philippe Mathieu-Daudé, 2020/06/26
- [PATCH v4 10/14] hw/sd/sdcard: Constify sd_crc*()'s message argument, Philippe Mathieu-Daudé, 2020/06/26
- [PATCH v4 12/14] hw/sd/sdcard: Correctly display the command name in trace events, Philippe Mathieu-Daudé, 2020/06/26
- [PATCH v4 13/14] hw/sd/sdcard: Display offset in read/write_data() trace events, Philippe Mathieu-Daudé, 2020/06/26
- [PATCH v4 11/14] hw/sd/sdcard: Make iolen unsigned, Philippe Mathieu-Daudé, 2020/06/26
- [PATCH v4 14/14] hw/sd/sdcard: Simplify realize() a bit, Philippe Mathieu-Daudé, 2020/06/26
- Re: [PATCH v4 00/14] hw/sd/sdcard: Fix CVE-2020-13253 & cleanups, Philippe Mathieu-Daudé, 2020/06/26
- Re: [PATCH v4 00/14] hw/sd/sdcard: Fix CVE-2020-13253 & cleanups, no-reply, 2020/06/26
- Re: [PATCH v4 00/14] hw/sd/sdcard: Fix CVE-2020-13253 & cleanups, no-reply, 2020/06/26