Re: [Qemu-devel] [PATCH for-3.1 1/2] hw/block/onenand: Fix off-by-one error allowing out-of-bounds read

2018-11-15 Thread Richard Henderson
On 11/15/18 3:35 PM, Peter Maydell wrote: > An off-by-one error in a switch case in onenand_read() allowed > a misbehaving guest to read off the end of a block of memory. > > NB: the onenand device is used only by the "n800" and "n810" > machines, which are usable only with TCG, not KVM, so this

Re: [Qemu-devel] [PATCH for-3.1 1/2] hw/block/onenand: Fix off-by-one error allowing out-of-bounds read

2018-11-15 Thread Philippe Mathieu-Daudé
On 15/11/18 15:35, Peter Maydell wrote: An off-by-one error in a switch case in onenand_read() allowed a misbehaving guest to read off the end of a block of memory. NB: the onenand device is used only by the "n800" and "n810" machines, which are usable only with TCG, not KVM, so this is not a

[Qemu-devel] [PATCH for-3.1 1/2] hw/block/onenand: Fix off-by-one error allowing out-of-bounds read

2018-11-15 Thread Peter Maydell
An off-by-one error in a switch case in onenand_read() allowed a misbehaving guest to read off the end of a block of memory. NB: the onenand device is used only by the "n800" and "n810" machines, which are usable only with TCG, not KVM, so this is not a security issue. Reported-by: Thomas Huth