14.09.2023 15:37, Michael Tokarev:
13.09.2023 13:10, Dmitry Frolov wrote:
According to cxl_interleave_ways_enc(),
fw->num_targets is allowed to be up to 16.
This also corresponds to CXL specs.
So, the fw->target_hbs[] array is iterated from 0 to 15.
But it is staticaly declared of length 8.
Thus, out of bound array access may occur.
Fixes: c28db9e000 ("hw/pci-bridge: Make PCIe and CXL PXB Devices inherit from
TYPE_PXB_DEV")
Signed-off-by: Dmitry Frolov <fro...@swemel.ru>
Reviewed-by: Michael Tokarev <m...@tls.msk.ru>
(with the extra empty line removed :)
Also,
Cc: qemu-sta...@nongnu.org
for stable-8.1.
/mjt
