Thanks Peter! Good catch on the read function, I totally missed that part of it while focusing just on the main issue.
It makes complete sense to clean up both functions together in your fix. This was a great learning experience for me, so thank you for taking the time to review and share feedback. Best, Samanyu On Mon, Oct 19, 2026, 21:46 Peter Maydell <[email protected]> wrote: > On Mon, 19 Oct 2026 at 16:55, Samanyu Goel <[email protected]> > wrote: > > > > In exynos4210_combiner_write(), the bounds check used req_quad_base_n > > instead of grp_quad_base_n. Because req_quad_base_n counts 4-group blocks > > rather than individual groups, invalid offsets were allowed through. > > > > For example, writing to offset 0x100 resulted in req_quad_base_n = 16, > > passing the check (16 < 64). As verified in GDB, this caused > > grp_quad_base_n to reach 64, leading to an out-of-bounds write at > > s->group[64]. > > > > Signed-off-by: Samanyu Goel <[email protected]> > > --- > > This is https://gitlab.com/qemu-project/qemu/-/work_items/4709. > > You've missed the equivalent check in the read function. > > As it happens I was working on this bug this afternoon; I have > a patch nearly ready to send which fixes this and also cleans up > some other oddities about the checks in these functions. > > thanks > -- PMM >
