qemu-e2k/include
Frederic Konrad 90bb6d6764 hw/ssi/xilinx_spips: fix an out of bound access
The spips, qspips, and zynqmp-qspips share the same realize function
(xilinx_spips_realize) and initialize their io memory region with different
mmio_ops passed through the class.  The size of the memory region is set to
the largest area (0x200 bytes for zynqmp-qspips) thus it is possible to write
out of s->regs[addr] in xilinx_spips_write for spips and qspips.

This fixes that wrong behavior.

Reviewed-by: Luc Michel <luc.michel@amd.com>
Signed-off-by: Frederic Konrad <fkonrad@amd.com>
Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Message-id: 20231124143505.1493184-2-fkonrad@amd.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-11-27 15:38:43 +00:00
..
authz
block
chardev
crypto
disas
exec
fpu
gdbstub
hw hw/ssi/xilinx_spips: fix an out of bound access 2023-11-27 15:38:43 +00:00
io
libdecnumber
migration
monitor
net
qapi
qemu
qom
scsi
semihosting
standard-headers
sysemu
tcg
ui
user
elf.h
glib-compat.h
qemu-io.h
qemu-main.h