Merge pull request #169 from flaviojs/fix-out-of-bounds-read-mpc860_s…

…pi_fetch_bd Fix out-of-bounds read in mpc860_spi_fetch_bd.
GNS3 · Mar 13, 2024 · 6560b33 · 6560b33
2 parents 2a5884f + 58ad98a
commit 6560b33
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/common/dev_mpc860.c b/common/dev_mpc860.c
@@ -654,7 +654,7 @@ static void mpc860_spi_init_rx_tx_params(struct mpc860_data *d)
 static int mpc860_spi_fetch_bd(struct mpc860_data *d,m_uint16_t bd_addr,
                                struct mpc860_spi_bd *bd)
 {
-   if ((bd_addr < MPC860_DPRAM_OFFSET) || (bd_addr > MPC860_DPRAM_END))
+   if ((bd_addr < MPC860_DPRAM_OFFSET) || (bd_addr >= MPC860_DPRAM_END - MPC860_SPI_BD_SIZE))
       return(-1);
 
    bd->offset = bd_addr - MPC860_DPRAM_OFFSET;