From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:47869) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WFPcq-0000Mo-R1 for qemu-devel@nongnu.org; Mon, 17 Feb 2014 09:56:53 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1WFPcp-0000Of-KP for qemu-devel@nongnu.org; Mon, 17 Feb 2014 09:56:52 -0500 Received: from mnementh.archaic.org.uk ([2001:8b0:1d0::1]:45973) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WFPcp-0000OQ-E3 for qemu-devel@nongnu.org; Mon, 17 Feb 2014 09:56:51 -0500 From: Peter Maydell Date: Mon, 17 Feb 2014 14:37:32 +0000 Message-Id: <1392647854-8067-2-git-send-email-peter.maydell@linaro.org> In-Reply-To: <1392647854-8067-1-git-send-email-peter.maydell@linaro.org> References: <1392647854-8067-1-git-send-email-peter.maydell@linaro.org> Subject: [Qemu-devel] [PATCH 1/3] hw/misc/arm_sysctl: Fix bad boundary check on mb clock accesses List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: patches@linaro.org Fix incorrect use of sizeof() rather than ARRAY_SIZE() to guard accesses into the mb_clock[] array, which was allowing a malicious guest to overwrite the end of the array. Signed-off-by: Peter Maydell --- hw/misc/arm_sysctl.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/hw/misc/arm_sysctl.c b/hw/misc/arm_sysctl.c index 0fc26d2..3fad6f8 100644 --- a/hw/misc/arm_sysctl.c +++ b/hw/misc/arm_sysctl.c @@ -276,7 +276,7 @@ static bool vexpress_cfgctrl_read(arm_sysctl_state *s, unsigned int dcc, } break; case SYS_CFG_OSC: - if (site == SYS_CFG_SITE_MB && device < sizeof(s->mb_clock)) { + if (site == SYS_CFG_SITE_MB && device < ARRAY_SIZE(s->mb_clock)) { /* motherboard clock */ *val = s->mb_clock[device]; return true; @@ -324,7 +324,7 @@ static bool vexpress_cfgctrl_write(arm_sysctl_state *s, unsigned int dcc, switch (function) { case SYS_CFG_OSC: - if (site == SYS_CFG_SITE_MB && device < sizeof(s->mb_clock)) { + if (site == SYS_CFG_SITE_MB && device < ARRAY_SIZE(s->mb_clock)) { /* motherboard clock */ s->mb_clock[device] = val; return true; -- 1.8.5