P J P 2b433ca6f5 sd: sdhci: check data length during dma_memory_read ...

While doing multi block SDMA transfer in routine
'sdhci_sdma_transfer_multi_blocks', the 's->fifo_buffer' starting
index 'begin' and data length 's->data_count' could end up to be same.
This could lead to an OOB access issue. Correct transfer data length
to avoid it.

Reported-by: Jiang Xin <jiangxin1@huawei.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
[BR: CVE-2017-5667 BSC#1022541]
Signed-off-by: Bruce Rogers <brogers@suse.com>

2021-03-17 09:45:51 -06:00

..

core.c

hw/sd: Add QOM bus which SD cards plug in to

2016-02-18 14:26:33 +00:00

Makefile.objs

hw/sd: Add QOM bus which SD cards plug in to

2016-02-18 14:26:33 +00:00

milkymist-memcard.c

lm32: Clean up includes

2016-01-29 15:07:22 +00:00

omap_mmc.c

arm devices: Clean up includes

2016-01-29 15:07:25 +00:00

pl181.c

arm: Clean up includes

2016-01-29 15:07:23 +00:00

pxa2xx_mmci.c

include/qemu/osdep.h: Don't include qapi/error.h

2016-03-22 22:20:15 +01:00

sd.c

include/qemu/osdep.h: Don't include qapi/error.h

2016-03-22 22:20:15 +01:00

sdhci-internal.h

Replaced get_tick_per_sec() by NANOSECONDS_PER_SECOND

2016-03-22 22:20:17 +01:00

sdhci.c

sd: sdhci: check data length during dma_memory_read

2021-03-17 09:45:51 -06:00

ssi-sd.c

hw: Clean up includes

2016-01-29 15:07:25 +00:00