In exynos4210_combiner_write(), the bounds check used req_quad_base_n instead of grp_quad_base_n. Because req_quad_base_n counts 4-group blocks rather than individual groups, invalid offsets were allowed through.
For example, writing to offset 0x100 resulted in req_quad_base_n = 16, passing the check (16 < 64). As verified in GDB, this caused grp_quad_base_n to reach 64, leading to an out-of-bounds write at s->group[64]. Signed-off-by: Samanyu Goel <[email protected]> --- hw/intc/exynos4210_combiner.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/intc/exynos4210_combiner.c b/hw/intc/exynos4210_combiner.c index dbbdee4d31..458949e8bb 100644 --- a/hw/intc/exynos4210_combiner.c +++ b/hw/intc/exynos4210_combiner.c @@ -184,7 +184,7 @@ static void exynos4210_combiner_write(void *opaque, hwaddr offset, grp_quad_base_n = req_quad_base_n << 2; reg_n = (offset - (req_quad_base_n << 4)) >> 2; - if (req_quad_base_n >= IIC_NGRP) { + if (grp_quad_base_n >= IIC_NGRP) { qemu_log_mask(LOG_GUEST_ERROR, "exynos4210.combiner: unallowed write access at offset 0x" HWADDR_FMT_plx "\n", offset); -- 2.53.0
