diff options
| author | Prasad J Pandit <pjp@fedoraproject.org> | 2016-02-11 11:17:32 +0000 |
|---|---|---|
| committer | Timothy Pearson <tpearson@raptorengineering.com> | 2019-11-29 19:43:57 -0600 |
| commit | 810d2bcf36f950cbeb9b19e9ba4821ee0ca0a74f (patch) | |
| tree | bd8dab10b332afac9d8258bcd2a4691c1a03880a | |
| parent | 82fe76fbf04b84f130b9c5c8c3f3666958e74227 (diff) | |
| download | hqemu-810d2bcf36f950cbeb9b19e9ba4821ee0ca0a74f.zip hqemu-810d2bcf36f950cbeb9b19e9ba4821ee0ca0a74f.tar.gz | |
sd: limit 'req.cmd' while using as an array index
While processing standard SD commands, the 'req.cmd' value could
lead to OOB read when used as an index into 'sd_cmd_type' or
'sd_cmd_class' arrays. Limit 'req.cmd' value to avoid such an
access.
Reported-by: Qinghao Tang <luodalongde@gmail.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1453315857-1352-1-git-send-email-ppandit@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| -rw-r--r-- | hw/sd/sd.c | 7 |
1 files changed, 5 insertions, 2 deletions
@@ -669,8 +669,10 @@ static sd_rsp_type_t sd_normal_command(SDState *sd, /* Not interpreting this as an app command */ sd->card_status &= ~APP_CMD; - if (sd_cmd_type[req.cmd] == sd_ac || sd_cmd_type[req.cmd] == sd_adtc) + if (sd_cmd_type[req.cmd & 0x3F] == sd_ac + || sd_cmd_type[req.cmd & 0x3F] == sd_adtc) { rca = req.arg >> 16; + } DPRINTF("CMD%d 0x%08x state %d\n", req.cmd, req.arg, sd->state); switch (req.cmd) { @@ -1341,7 +1343,8 @@ static int cmd_valid_while_locked(SDState *sd, SDRequest *req) if (req->cmd == 16 || req->cmd == 55) { return 1; } - return sd_cmd_class[req->cmd] == 0 || sd_cmd_class[req->cmd] == 7; + return sd_cmd_class[req->cmd & 0x3F] == 0 + || sd_cmd_class[req->cmd & 0x3F] == 7; } int sd_do_command(SDState *sd, SDRequest *req, |
