mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

hw/nubus/nubus-device: Range check 'slot' property

Browse Source 
The TYPE_NUBUS_DEVICE class lets the user specify the nubus slot
using an int32 "slot" QOM property.  Its realize method doesn't do
any range checking on this value, which Coverity notices by way of
the possibility that 'nd->slot * NUBUS_SUPER_SLOT_SIZE' might
overflow the 32-bit arithmetic it is using.

Constrain the slot value to be less than NUBUS_SLOT_NB (16).

Resolves: Coverity CID 1464070
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-ID: <20240830173452.2086140-4-peter.maydell@linaro.org>
Reviewed-by: Thomas Huth <huth@tuxfamily.org>
Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Signed-off-by: Thomas Huth <huth@tuxfamily.org>
This commit is contained in:
Peter Maydell 2024-08-30 18:34:52 +01:00 committed by Thomas Huth
parent 175f5a5b48
commit df827aace6
1 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
hw/nubus/nubus-device.c
View File

@ -35,6 +35,13 @@ static void nubus_device_realize(DeviceState *dev, Error **errp)
uint8_t *rom_ptr; uint8_t *rom_ptr;
int ret; int ret;
if (nd->slot < 0 || nd->slot >= NUBUS_SLOT_NB) {
error_setg(errp,
"'slot' value %d out of range (must be between 0 and %d)",
nd->slot, NUBUS_SLOT_NB - 1);
return;
}
/* Super */ /* Super */
slot_offset = nd->slot * NUBUS_SUPER_SLOT_SIZE; slot_offset = nd->slot * NUBUS_SUPER_SLOT_SIZE;