From patchwork Mon Nov 26 20:04:34 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Corey Minyard X-Patchwork-Id: 10699137 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 018031803 for ; Mon, 26 Nov 2018 20:29:33 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id E63CE2A403 for ; Mon, 26 Nov 2018 20:29:32 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id DA1AB2A41D; Mon, 26 Nov 2018 20:29:32 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.7 required=2.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,MAILING_LIST_MULTI,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 7ACAA2A403 for ; Mon, 26 Nov 2018 20:29:32 +0000 (UTC) Received: from localhost ([::1]:38700 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gRNVb-0006q2-HK for patchwork-qemu-devel@patchwork.kernel.org; Mon, 26 Nov 2018 15:29:31 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:53705) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gRN81-0001lF-CQ for qemu-devel@nongnu.org; Mon, 26 Nov 2018 15:05:11 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1gRN7w-0001Jc-8S for qemu-devel@nongnu.org; Mon, 26 Nov 2018 15:05:09 -0500 Received: from mail-oi1-x244.google.com ([2607:f8b0:4864:20::244]:47032) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1gRN7u-0001H8-9D for qemu-devel@nongnu.org; Mon, 26 Nov 2018 15:05:02 -0500 Received: by mail-oi1-x244.google.com with SMTP id x202so17050059oif.13 for ; Mon, 26 Nov 2018 12:04:55 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=sender:from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=cjeMGIE0pgix09b05qlSTdvqB0XhGGSsFnDFBbWuJts=; b=irywiFNvDNUHOUPftBXILi3sW5sw4Nm9Tk7LmDfHUamLHwQaJZcROBUb66gcf2VDiP xB9y2TyfsBRzYld6RdXjLyLdThmFskDbXIUsP+cqNDpsFsr0NTlrhKLszdt4VPWQ5zc7 +bqTTQA3AiA1+8ptzzxcZeljD0lyv87Wr8r6Av8bYG2KNM5dZhZkq3otzLVgOMPNC1Ig CXX4EHSFikX+b9Bi5udH2q4BmnFRlSo0vcn+nyAuhguwVvUog+vR7asEITI8U8TG8JDC /O0tGbRvZ8FW/HyhRSRxGHOaiaMdWxDQOyqO8Orf8Dn8OUnnk5cxPlj7/fJupgg3IYDD FrrQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:sender:from:to:cc:subject:date:message-id :in-reply-to:references:mime-version:content-transfer-encoding; bh=cjeMGIE0pgix09b05qlSTdvqB0XhGGSsFnDFBbWuJts=; b=VHI3A0rxvXOupRUEfsXAA4XymZHVQZVBIm00oM9ZigTgdDTbja2XKYfZcwlcWuJ//H syDryDd8rSI3tjJfDqAja2SlMaBf4KHD1h3+sHMPnrEfEtHvflQDQ+GRv1py0lr8UHRV KwJpl8w96cD9rS91zHqRo0ppQsEGEY2VktFo1yQNuf3OAfG3N6dfyfx+LB5VCvWYQ7lr cPYknvoth+xKSbTSUCZEgpzP5GUbhSD5UNmzZtQD8wkOW5wO/yAFw3NkoLsZMMcFEiAo OsOSVpD1LsqwgZ7hdGAoCjab53LU928K5UIgVYQvXMbbIw+XA5CIr21ZFTwx5BntJeeP PStw== X-Gm-Message-State: AA+aEWYeBGrptiLQKrk1DhREH4wAQjygrCoqipcFU0BKaruWTfE4EXES CN6iWwRDvzep8of8S78hFg== X-Google-Smtp-Source: AFSGD/UQdldPAI7kQRYyiTDUEganvCMb89+CkNqKOZVYvbzQUpQS7sT0Ia3cfz7x6knXgWuPhqPEcA== X-Received: by 2002:aca:b555:: with SMTP id e82-v6mr7157228oif.127.1543262695072; Mon, 26 Nov 2018 12:04:55 -0800 (PST) Received: from serve.minyard.net ([47.184.128.64]) by smtp.gmail.com with ESMTPSA id g38sm420436otb.77.2018.11.26.12.04.50 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 26 Nov 2018 12:04:52 -0800 (PST) Received: from t430.minyard.net (t430m.minyard.net [192.168.27.3]) by serve.minyard.net (Postfix) with ESMTPA id 859E0107F; Mon, 26 Nov 2018 14:04:48 -0600 (CST) Received: by t430.minyard.net (Postfix, from userid 1000) id E49BC301470; Mon, 26 Nov 2018 14:04:46 -0600 (CST) From: minyard@acm.org To: qemu-devel@nongnu.org, "Dr . David Alan Gilbert" , =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= , Peter Maydell Date: Mon, 26 Nov 2018 14:04:34 -0600 Message-Id: <20181126200435.23408-16-minyard@acm.org> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20181126200435.23408-1-minyard@acm.org> References: <20181126200435.23408-1-minyard@acm.org> MIME-Version: 1.0 X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 2607:f8b0:4864:20::244 Subject: [Qemu-devel] [PATCH v3 15/16] hw/i2c/smbus_eeprom: Create at most SMBUS_EEPROM_MAX EEPROMs on a SMBus X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Paolo Bonzini , Corey Minyard , Corey Minyard , "Michael S . Tsirkin" Errors-To: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Sender: "Qemu-devel" X-Virus-Scanned: ClamAV using ClamSMTP From: Philippe Mathieu-Daudé Calling smbus_eeprom_init() with more than 8 EEPROMs would lead to a heap overflow. Replace the '8' magic number by a definition, and check no more than this number are created. Signed-off-by: Philippe Mathieu-Daudé Signed-off-by: Corey Minyard --- hw/i2c/smbus_eeprom.c | 13 +++++++++++-- include/hw/i2c/smbus_eeprom.h | 4 +++- 2 files changed, 14 insertions(+), 3 deletions(-) diff --git a/hw/i2c/smbus_eeprom.c b/hw/i2c/smbus_eeprom.c index 942057dc10..a0dcadbd60 100644 --- a/hw/i2c/smbus_eeprom.c +++ b/hw/i2c/smbus_eeprom.c @@ -23,6 +23,7 @@ */ #include "qemu/osdep.h" +#include "qemu/error-report.h" #include "hw/hw.h" #include "hw/boards.h" #include "hw/i2c/i2c.h" @@ -157,12 +158,20 @@ void smbus_eeprom_init_one(I2CBus *smbus, uint8_t address, uint8_t *eeprom_buf) qdev_init_nofail(dev); } -void smbus_eeprom_init(I2CBus *smbus, int nb_eeprom, +void smbus_eeprom_init(I2CBus *smbus, unsigned int nb_eeprom, const uint8_t *eeprom_spd, int eeprom_spd_size) { int i; + uint8_t *eeprom_buf; + + if (nb_eeprom > SMBUS_EEPROM_MAX) { + error_report("At most %u EEPROM are supported on a SMBus.", + SMBUS_EEPROM_MAX); + exit(1); + } + /* XXX: make this persistent */ - uint8_t *eeprom_buf = g_malloc0(8 * SMBUS_EEPROM_SIZE); + eeprom_buf = g_malloc0(nb_eeprom * SMBUS_EEPROM_SIZE); if (eeprom_spd_size > 0) { memcpy(eeprom_buf, eeprom_spd, eeprom_spd_size); } diff --git a/include/hw/i2c/smbus_eeprom.h b/include/hw/i2c/smbus_eeprom.h index 46fb1a37d6..8436200599 100644 --- a/include/hw/i2c/smbus_eeprom.h +++ b/include/hw/i2c/smbus_eeprom.h @@ -25,8 +25,10 @@ #include "hw/i2c/i2c.h" +#define SMBUS_EEPROM_MAX 8 + void smbus_eeprom_init_one(I2CBus *bus, uint8_t address, uint8_t *eeprom_buf); -void smbus_eeprom_init(I2CBus *bus, int nb_eeprom, +void smbus_eeprom_init(I2CBus *bus, unsigned int nb_eeprom, const uint8_t *eeprom_spd, int size); #endif