From patchwork Tue Aug 24 06:34:28 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Subject: [3/3] Check pci slot number in parse_pci_devfn Date: Mon, 23 Aug 2010 20:34:28 -0000 From: Ken CC X-Patchwork-Id: 62554 Message-Id: <20100824063428.GC10815@kt> To: kvm@vger.kernel.org Cc: yamahata@valinux.co.jp, qemu-devel@nongnu.org Define MAX_PCI_SLOTS as 0x1f, if pci addr provided from command line is bigger than 0x1f, return error -EINVAL. 0x1f << 3 | 7 == 255 (PCIBUS_MAX_DEVICES - 1) Signed-off-by: Ken CC --- hw/qdev-properties.c | 2 ++ hw/qdev.h | 3 +++ 2 files changed, 5 insertions(+), 0 deletions(-) diff --git a/hw/qdev-properties.c b/hw/qdev-properties.c index 9219cd7..96d814c 100644 --- a/hw/qdev-properties.c +++ b/hw/qdev-properties.c @@ -514,6 +514,8 @@ static int parse_pci_devfn(DeviceState *dev, Property *prop, const char *str) return -EINVAL; } } + if (slot > MAX_PCI_SLOTS) + return -EINVAL; if (str[n] != '\0') return -EINVAL; if (fn > 7) diff --git a/hw/qdev.h b/hw/qdev.h index 678f8b7..fcfe52e 100644 --- a/hw/qdev.h +++ b/hw/qdev.h @@ -7,6 +7,9 @@ #include "qemu-char.h" #include "qemu-option.h" + +#define MAX_PCI_SLOTS 0x1f + typedef struct Property Property; typedef struct PropertyInfo PropertyInfo;