diff options
| author |   Dmitry Frolov <frolov@swemel.ru> | 2023-09-19 11:19:25 +0100 |
|---|---|---|
| committer |   Michael Tokarev <mjt@tls.msk.ru> | 2023-09-21 11:31:18 +0300 |
| commit | de5bbfc602ef1b9b79c494a914c6083a1a23cca2 (patch) | |
| tree | 0b113b4d364c64041b1af493431b1c70ff406c08 /scripts/qapi/source.py | |
| parent | docs/cxl: Change to lowercase as others (diff) | |
| download | qemu-de5bbfc602ef1b9b79c494a914c6083a1a23cca2.tar.xz qemu-de5bbfc602ef1b9b79c494a914c6083a1a23cca2.zip | |
hw/cxl: Fix out of bound array access
According to cxl_interleave_ways_enc(), fw->num_targets is allowed to be up
to 16. This also corresponds to CXL r3.0 spec. So, the fw->target_hbs[]
array is iterated from 0 to 15. But it is statically declared of length 8.
Thus, out of bound array access may occur.
Fixes: c28db9e000 ("hw/pci-bridge: Make PCIe and CXL PXB Devices inherit from TYPE_PXB_DEV")
Signed-off-by: Dmitry Frolov <frolov@swemel.ru>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Link: https://lore.kernel.org/r/20230913101055.754709-1-frolov@swemel.ru
Cc: qemu-stable@nongnu.org
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Diffstat (limited to 'scripts/qapi/source.py')
0 files changed, 0 insertions, 0 deletions