On Mon, 19 Oct 2026 at 16:55, Samanyu Goel <[email protected]> wrote: > > In exynos4210_combiner_write(), the bounds check used req_quad_base_n > instead of grp_quad_base_n. Because req_quad_base_n counts 4-group blocks > rather than individual groups, invalid offsets were allowed through. > > For example, writing to offset 0x100 resulted in req_quad_base_n = 16, > passing the check (16 < 64). As verified in GDB, this caused > grp_quad_base_n to reach 64, leading to an out-of-bounds write at > s->group[64]. > > Signed-off-by: Samanyu Goel <[email protected]> > ---
This is https://gitlab.com/qemu-project/qemu/-/work_items/4709. You've missed the equivalent check in the read function. As it happens I was working on this bug this afternoon; I have a patch nearly ready to send which fixes this and also cleans up some other oddities about the checks in these functions. thanks -- PMM
