> Subject: [PATCH] hw/misc/aspeed_hace: Fix OOB read in has_padding()
>
> When total_msg_len equals total_req_len, padding_size is 0, making
> pad_offset equal to req_len. The subsequent padding[pad_offset] read
> accesses one byte past the buffer. Return false early when padding_size is
> zero.
>
> Fixes: 5cd7d8564a8b ("aspeed/hace: Support AST2600 HACE")
> Reported-by: Christopher Boker <[email protected]>
> Signed-off-by: Cédric Le Goater <[email protected]>
> ---
> hw/misc/aspeed_hace.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/hw/misc/aspeed_hace.c b/hw/misc/aspeed_hace.c index
> 8de05a9d98b3..bf8af710335d 100644
> --- a/hw/misc/aspeed_hace.c
> +++ b/hw/misc/aspeed_hace.c
> @@ -225,7 +225,7 @@ static bool has_padding(AspeedHACEState *s, struct
> iovec *iov,
> uint32_t padding_size = s->total_req_len - *total_msg_len;
> uint8_t *padding = iov->iov_base;
>
> - if (padding_size > req_len) {
> + if (padding_size == 0 || padding_size > req_len) {
> return false;
> }
>
> --
> 2.55.0
Reviewed-by: Jamin Lin <[email protected]>
Thanks,
Jamin
