The guest-controlled data_len register is uint32_t, but was copied into a signed int. A value of 0xffffffff consequently became -1, allowing the DMA transfer size to exceed the 128-byte stack buffer.
Use an unsigned length variable so that each transfer remains bounded by GOLFISH_TTY_BUFFER_SIZE. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4245 Signed-off-by: Laurent Vivier <[email protected]> --- hw/char/goldfish_tty.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/char/goldfish_tty.c b/hw/char/goldfish_tty.c index 8e1e9228c78b..f64527f50a02 100644 --- a/hw/char/goldfish_tty.c +++ b/hw/char/goldfish_tty.c @@ -71,7 +71,7 @@ static void goldfish_tty_cmd(GoldfishTTYState *s, uint32_t cmd) { uint32_t to_copy; uint8_t data_out[GOLFISH_TTY_BUFFER_SIZE]; - int len; + unsigned int len; uint64_t ptr; switch (cmd) { -- 2.55.0
