starred/qemu-qemu-1
1
0
Fork 0
mirror of https://github.com/qemu/qemu.git synced 2026-07-08 17:56:38 +00:00
Code Issues Packages Projects Releases Wiki Activity

hw/gpio/pca9552: fix off-by-one in QOM led index validation

Browse Source 
pca955x_get_led() and pca955x_set_led() accept led indices equal to
pin_count, but valid indices are 0..pin_count-1.  For a 16-pin device,
led16 passes the current check and then accesses an LS register past
max_reg.

Use the same >= pin_count bounds check as pca9554_set_pin() and the
gpio input handler assert in this file.

Fixes: a90d8f8467 ("misc/pca9552: Add qom set and get")
Signed-off-by: yujun <yujun@kylinos.cn>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Glenn Miles <milesg@linux.ibm.com>
Message-ID: <20260629074133.187549-1-yujun@kylinos.cn>
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
This commit is contained in:
yujun
2026-06-29 15:41:33 +08:00
committed by Philippe Mathieu-Daudé
parent 067229e249
commit 59b748ac6a
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
hw/gpio/pca9552.c
View File

@@ -311,8 +311,8 @@ static void pca955x_get_led(Object *obj, Visitor *v, const char *name,
error_setg(errp, "%s: error reading %s", __func__, name);
return;
}
if (led < 0 || led > k->pin_count) {
error_setg(errp, "%s invalid led %s", __func__, name);
if (led < 0 || led >= k->pin_count) {
error_setg(errp, "%s: invalid led %s", __func__, name);
return;
}
/*
@@ -352,8 +352,8 @@ static void pca955x_set_led(Object *obj, Visitor *v, const char *name,
error_setg(errp, "%s: error reading %s", __func__, name);
return;
}
if (led < 0 || led > k->pin_count) {
error_setg(errp, "%s invalid led %s", __func__, name);
if (led < 0 || led >= k->pin_count) {
error_setg(errp, "%s: invalid led %s", __func__, name);
return;
}