From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:41544) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aLsaQ-00072n-7Q for qemu-devel@nongnu.org; Wed, 20 Jan 2016 08:14:15 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1aLsaN-0001OB-0o for qemu-devel@nongnu.org; Wed, 20 Jan 2016 08:14:10 -0500 Received: from mx1.redhat.com ([209.132.183.28]:55292) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aLsaM-0001O7-Ru for qemu-devel@nongnu.org; Wed, 20 Jan 2016 08:14:06 -0500 From: P J P Date: Wed, 20 Jan 2016 18:44:00 +0530 Message-Id: <1453295640-28120-1-git-send-email-ppandit@redhat.com> Subject: [Qemu-devel] [PATCH] sd: limit sd_cmd_type array index 'req.cmd' List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Qinghao Tang , Peter Maydell , Prasad J Pandit From: Prasad J Pandit While processing standard SD commands, the 'req.cmd' value could lead to OOB read when used as an index into 'sd_cmd_type' array. Limit 'req.cmd' value to avoid such an access. Reported-by: Qinghao Tang Signed-off-by: Prasad J Pandit --- hw/sd/sd.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/hw/sd/sd.c b/hw/sd/sd.c index 1a9935c..b800ced 100644 --- a/hw/sd/sd.c +++ b/hw/sd/sd.c @@ -668,8 +668,10 @@ static sd_rsp_type_t sd_normal_command(SDState *sd, /* Not interpreting this as an app command */ sd->card_status &= ~APP_CMD; - if (sd_cmd_type[req.cmd] == sd_ac || sd_cmd_type[req.cmd] == sd_adtc) + if (sd_cmd_type[req.cmd & 0x3F] == sd_ac + || sd_cmd_type[req.cmd & 0x3F] == sd_adtc) { rca = req.arg >> 16; + } DPRINTF("CMD%d 0x%08x state %d\n", req.cmd, req.arg, sd->state); switch (req.cmd) { -- 2.5.0