Reject migrated state where the register index exceeds the valid
range, preventing out-of-bounds access.
Fixes: bdb78cae61ec ("escc: convert to VMState, vmsd and reset")
Reported-by: Pavee Hui <[email protected]>
Signed-off-by: Marc-André Lureau <[email protected]>
---
hw/char/escc.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/hw/char/escc.c b/hw/char/escc.c
index 7aae627fb48f..1543ca680358 100644
--- a/hw/char/escc.c
+++ b/hw/char/escc.c
@@ -764,10 +764,21 @@ static void serial_event(void *opaque, QEMUChrEvent event)
}
}
+static int escc_chn_post_load(void *opaque, int version_id)
+{
+ ESCCChannelState *s = opaque;
+
+ if (s->reg >= ESCC_SERIAL_REGS) {
+ return -EINVAL;
+ }
+ return 0;
+}
+
static const VMStateDescription vmstate_escc_chn = {
.name = "escc_chn",
.version_id = 2,
.minimum_version_id = 1,
+ .post_load = escc_chn_post_load,
.fields = (const VMStateField[]) {
VMSTATE_UINT32(vmstate_dummy, ESCCChannelState),
VMSTATE_UINT32(reg, ESCCChannelState),
--
2.56.0.rc0.29.g47ce80527c56
