![Mark Cave-Ayland](/assets/img/avatar_default.png)
The case statements in the CG3 read and write register routines have a maximum value of CG3_REG_SIZE, so if a value were written to this offset then it would overflow the register array. Currently this cannot be exploited since the MemoryRegion restricts accesses to the range 0 ... CG3_REG_SIZE - 1, but it seems worth clarifying this for future review and/or static analysis. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> CC: Paolo Bonzini <pbonzini@redhat.com>
…
…
…
…
…
…
…
…
…
…
…
…
…
…
…
…
…
…
…
…
…
…
…
…
Read the documentation in qemu-doc.html or on http://wiki.qemu-project.org - QEMU team
Description
Languages
C
82.6%
C++
6.5%
Python
3.4%
Dylan
2.9%
Shell
1.6%
Other
2.8%