[Qemu-commits] [qemu/qemu] 68716d: apb: Fix out-of-bounds array write access

[GitHub]

  Branch: refs/heads/master
  Home:   https://github.com/qemu/qemu
  Commit: 68716da745858ca86ac587d14ac553051e5f04eb
      
https://github.com/qemu/qemu/commit/68716da745858ca86ac587d14ac553051e5f04eb
  Author: Stefan Weil <address@hidden>
  Date:   2014-06-20 (Fri, 20 Jun 2014)

  Changed paths:
    M hw/pci-host/apb.c

  Log Message:
  -----------
  apb: Fix out-of-bounds array write access

The array regs is declared with IOMMU_NREGS (3) elements and accessed
using IOMMU_CTRL (0) and IOMMU_BASE (8). In most cases, those values
are right shifted before being used as an index which results in indices
0 and 1. In one case, this right shift was missing for IOMMU_BASE which
results in an out-of-bounds write access with index 8.

The patch adds the missing shift operation also for IOMMU_CTRL where
it is needed only for cosmetic reasons.

Signed-off-by: Stefan Weil <address@hidden>
Signed-off-by: Mark Cave-Ayland <address@hidden>


  Commit: 871c60a7368dbfcb7b2620b0483eed8305fd7b6b
      
https://github.com/qemu/qemu/commit/871c60a7368dbfcb7b2620b0483eed8305fd7b6b
  Author: Mark Cave-Ayland <address@hidden>
  Date:   2014-06-20 (Fri, 20 Jun 2014)

  Changed paths:
    M pc-bios/openbios-ppc
    M pc-bios/openbios-sparc32
    M pc-bios/openbios-sparc64
    M roms/openbios

  Log Message:
  -----------
  Update OpenBIOS images

Update OpenBIOS images to SVN r1306 built from submodule.

Signed-off-by: Mark Cave-Ayland <address@hidden>


  Commit: 337b172bb970bb4f679bfbd9a9a749d210511817
      
https://github.com/qemu/qemu/commit/337b172bb970bb4f679bfbd9a9a749d210511817
  Author: Peter Maydell <address@hidden>
  Date:   2014-06-23 (Mon, 23 Jun 2014)

  Changed paths:
    M pc-bios/openbios-ppc
    M pc-bios/openbios-sparc32
    M pc-bios/openbios-sparc64
    M roms/openbios

  Log Message:
  -----------
  Merge remote-tracking branch 'remotes/mcayland/qemu-openbios' into staging

* remotes/mcayland/qemu-openbios:
  Update OpenBIOS images

Signed-off-by: Peter Maydell <address@hidden>


  Commit: 910f66fcda2d410249697d959dcbdf8c82d77844
      
https://github.com/qemu/qemu/commit/910f66fcda2d410249697d959dcbdf8c82d77844
  Author: Peter Maydell <address@hidden>
  Date:   2014-06-23 (Mon, 23 Jun 2014)

  Changed paths:
    M hw/pci-host/apb.c

  Log Message:
  -----------
  Merge remote-tracking branch 'remotes/mcayland/qemu-sparc' into staging

* remotes/mcayland/qemu-sparc:
  apb: Fix out-of-bounds array write access

Signed-off-by: Peter Maydell <address@hidden>


Compare: https://github.com/qemu/qemu/compare/3840f8429043...910f66fcda2d