d6c3768b32
The ctz32() routine could return a value greater than TC6393XB_GPIOS=16, because the device has 24 GPIO level bits but we only implement 16 outgoing lines. This could lead to an OOB array access. Mask 'level' to avoid it. Reported-by: Moguofang <moguofang@huawei.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-id: 20171212041539.25700-1-ppandit@redhat.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> |
||
|---|---|---|
| .. | ||
| Makefile.objs | ||
| ads7846.c | ||
| bcm2835_fb.c | ||
| blizzard.c | ||
| cg3.c | ||
| cirrus_vga.c | ||
| cirrus_vga_rop.h | ||
| cirrus_vga_rop2.h | ||
| dpcd.c | ||
| exynos4210_fimd.c | ||
| framebuffer.c | ||
| framebuffer.h | ||
| g364fb.c | ||
| jazz_led.c | ||
| milkymist-tmu2.c | ||
| milkymist-vgafb.c | ||
| milkymist-vgafb_template.h | ||
| omap_dss.c | ||
| omap_lcd_template.h | ||
| omap_lcdc.c | ||
| pl110.c | ||
| pl110_template.h | ||
| pxa2xx_lcd.c | ||
| pxa2xx_template.h | ||
| qxl-logger.c | ||
| qxl-render.c | ||
| qxl.c | ||
| qxl.h | ||
| sm501.c | ||
| sm501_template.h | ||
| ssd0303.c | ||
| ssd0323.c | ||
| tc6393xb.c | ||
| tc6393xb_template.h | ||
| tcx.c | ||
| trace-events | ||
| vga-helpers.h | ||
| vga-isa-mm.c | ||
| vga-isa.c | ||
| vga-pci.c | ||
| vga.c | ||
| vga.h | ||
| vga_int.h | ||
| virtio-gpu-3d.c | ||
| virtio-gpu-pci.c | ||
| virtio-gpu.c | ||
| virtio-vga.c | ||
| vmware_vga.c | ||
| xenfb.c | ||
| xlnx_dp.c | ||