You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
qemu/hw/nubus
Peter Maydell df827aace6 hw/nubus/nubus-device: Range check 'slot' property
The TYPE_NUBUS_DEVICE class lets the user specify the nubus slot
using an int32 "slot" QOM property.  Its realize method doesn't do
any range checking on this value, which Coverity notices by way of
the possibility that 'nd->slot * NUBUS_SUPER_SLOT_SIZE' might
overflow the 32-bit arithmetic it is using.

Constrain the slot value to be less than NUBUS_SLOT_NB (16).

Resolves: Coverity CID 1464070
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-ID: <20240830173452.2086140-4-peter.maydell@linaro.org>
Reviewed-by: Thomas Huth <huth@tuxfamily.org>
Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Signed-off-by: Thomas Huth <huth@tuxfamily.org>
3 months ago
..
Kconfig
mac-nubus-bridge.c nubus-bridge: embed the NubusBus object directly within nubus-bridge 3 years ago
meson.build hw/nubus: add nubus-virtio-mmio device 9 months ago
nubus-bridge.c qbus: Rename qbus_create_inplace() to qbus_init() 3 years ago
nubus-bus.c nubus: move nubus to its own 32-bit address space 3 years ago
nubus-device.c hw/nubus/nubus-device: Range check 'slot' property 3 months ago
nubus-virtio-mmio.c hw/nubus/virtio-mmio: Fix missing ERRP_GUARD() in realize handler 4 months ago
trace-events trace-events: Fix the name of the tracing.rst file 1 year ago
trace.h nubus: add trace-events for empty slot accesses 3 years ago