diff mbox series

[v4,07/14] hw/sd/sdcard: Check address is in range

Message ID 20200626162818.25840-8-f4bug@amsat.org
State New
Headers show
Series hw/sd/sdcard: Fix CVE-2020-13253 & cleanups | expand

Commit Message

Philippe Mathieu-Daudé June 26, 2020, 4:28 p.m. UTC 
As a defense, assert if the requested address is out of the card area.

Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
---
 hw/sd/sd.c | 2 ++
 1 file changed, 2 insertions(+)
diff mbox series

Patch

diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index 871c30a67f..0b606e9054 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -539,6 +539,8 @@  static void sd_response_r7_make(SDState *sd, uint8_t *response)
 
 static inline uint64_t sd_addr_to_wpnum(uint64_t addr)
 {
+    assert(addr < sd->size);
+
     return addr >> (HWBLOCK_SHIFT + SECTOR_SHIFT + WPGROUP_SHIFT);
 }