[PATCH] hw/display: refine upper limit for offset value in assert check

2025-07-22 Thread gerben
From: Denis Rastyogin Accessing s->core_registers (size 236) could overflow if the offset goes beyond the valid range. Since the memory region matches core_registers size exactly, guest cannot write out-of-bounds. Therefore, the debug assert has been refined to ensure the offset remains within

Re: [PATCH] hw/display: refine upper limit for offset value in assert check

2024-12-12 Thread Richard Henderson
On 12/12/24 05:45, ger...@altlinux.org wrote: From: Denis Rastyogin Accessing an element of the s->core_registers array with a size of 236 (0x3AC) may lead to a buffer overflow, as the index 'offset' can exceed the valid range and reach values up to 5139 (0x504C >> 2). This change addresses a p

[PATCH] hw/display: refine upper limit for offset value in assert check

2024-12-12 Thread gerben
From: Denis Rastyogin Accessing an element of the s->core_registers array with a size of 236 (0x3AC) may lead to a buffer overflow, as the index 'offset' can exceed the valid range and reach values up to 5139 (0x504C >> 2). This change addresses a potential vulnerability when writing data. Found