mirror of
https://github.com/xemu-project/xemu.git
synced 2024-11-27 13:30:52 +00:00
5e73953a27
The ctucan device has 4 CAN bus cores, each of which has a set of 20 32-bit registers for writing the transmitted data. The registers are however not contiguous; each core's buffers is 0x100 bytes after the last. We got the checks on the address wrong in the ctucan_mem_write() function: * the first "is addr in range at all" check allowed addr == CTUCAN_CORE_MEM_SIZE, which is actually the first byte off the end of the range * the decode of addresses into core-number plus offset in the tx buffer for that core failed to check that the offset was in range, so the guest could write off the end of the tx_buffer[] array NB: currently the values of CTUCAN_CORE_MEM_SIZE, CTUCAN_CORE_TXBUF_NUM, etc, make "buff_num >= CTUCAN_CORE_TXBUF_NUM" impossible, but we retain this as a runtime check rather than an assertion to permit those values to be changed in future (in hardware they are configurable synthesis parameters). Fix the top level check, and check the offset is within the buffer. Fixes: Coverity CID 1432874 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Pavel Pisa <pisa@cmp.felk.cvut.cz> Tested-by: Pavel Pisa <pisa@cmp.felk.cvut.cz> Signed-off-by: Jason Wang <jasowang@redhat.com> |
||
|---|---|---|
| .. | ||
| can_kvaser_pci.c | ||
| can_mioe3680_pci.c | ||
| can_pcm3680_pci.c | ||
| can_sja1000.c | ||
| can_sja1000.h | ||
| ctu_can_fd_frame.h | ||
| ctu_can_fd_regs.h | ||
| ctucan_core.c | ||
| ctucan_core.h | ||
| ctucan_pci.c | ||
| meson.build | ||