Re: [Qemu-devel] [PATCH] apb: Fix out-of-bounds array write access

2014-06-17 Thread Mark Cave-Ayland
On 09/06/14 15:19, Stefan Weil wrote: The array regs is declared with IOMMU_NREGS (3) elements and accessed using IOMMU_CTRL (0) and IOMMU_BASE (8). In most cases, those values are right shifted before being used as an index which results in indices 0 and 1. In one case, this right shift was mis

Re: [Qemu-devel] [PATCH] apb: Fix out-of-bounds array write access

2014-06-10 Thread Mark Cave-Ayland
On 09/06/14 15:19, Stefan Weil wrote: Hi Stefan, The array regs is declared with IOMMU_NREGS (3) elements and accessed using IOMMU_CTRL (0) and IOMMU_BASE (8). In most cases, those values are right shifted before being used as an index which results in indices 0 and 1. In one case, this right s

Re: [Qemu-devel] [PATCH] apb: Fix out-of-bounds array write access

2014-06-09 Thread Stefan Weil
Am 09.06.2014 16:19, schrieb Stefan Weil: > The array regs is declared with IOMMU_NREGS (3) elements and accessed > using IOMMU_CTRL (0) and IOMMU_BASE (8). In most cases, those values > are right shifted before being used as an index which results in indices > 0 and 1. In one case, this right shif

[Qemu-devel] [PATCH] apb: Fix out-of-bounds array write access

2014-06-09 Thread Stefan Weil
The array regs is declared with IOMMU_NREGS (3) elements and accessed using IOMMU_CTRL (0) and IOMMU_BASE (8). In most cases, those values are right shifted before being used as an index which results in indices 0 and 1. In one case, this right shift was missing for IOMMU_BASE which results in an o