Date: Thu, 09 Jun 2022 23:19:49 +0000 From: bugzilla-noreply@freebsd.org To: virtualization@FreeBSD.org Subject: [Bug 264582] bhyve's hda_send_command() can index beyond the end of sc->codecs[] Message-ID: <bug-264582-27103@https.bugs.freebsd.org/bugzilla/>
next in thread | raw e-mail | index | archive | help
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D264582 Bug ID: 264582 Summary: bhyve's hda_send_command() can index beyond the end of sc->codecs[] Product: Base System Version: CURRENT Hardware: Any OS: Any Status: New Severity: Affects Some People Priority: --- Component: bhyve Assignee: virtualization@FreeBSD.org Reporter: rtm@lcs.mit.edu The guest specifies cad as a 4-bit field in verb, and thus can arrange for cad to be 15: hda_send_command(struct hda_softc *sc, uint32_t verb) { struct hda_codec_inst *hci =3D NULL; struct hda_codec_class *codec =3D NULL; uint8_t cad =3D (verb >> HDA_CMD_CAD_SHIFT) & 0x0f; hci =3D sc->codecs[cad]; But codecs[] has length 15 (HDA_CODEC_MAX). --=20 You are receiving this mail because: You are the assignee for the bug.=
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-264582-27103>