When total_msg_len equals total_req_len, padding_size is 0, making
pad_offset equal to req_len. The subsequent padding[pad_offset] read
accesses one byte past the buffer. Return false early when
padding_size is zero.
Fixes: 5cd7d8564a8b ("aspeed/hace: Support AST2600 HACE")
Reported-by: Christopher Boker <[email protected]>
Signed-off-by: Cédric Le Goater <[email protected]>
---
hw/misc/aspeed_hace.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/hw/misc/aspeed_hace.c b/hw/misc/aspeed_hace.c
index 8de05a9d98b3..bf8af710335d 100644
--- a/hw/misc/aspeed_hace.c
+++ b/hw/misc/aspeed_hace.c
@@ -225,7 +225,7 @@ static bool has_padding(AspeedHACEState *s, struct iovec
*iov,
uint32_t padding_size = s->total_req_len - *total_msg_len;
uint8_t *padding = iov->iov_base;
- if (padding_size > req_len) {
+ if (padding_size == 0 || padding_size > req_len) {
return false;
}
--
2.55.0
