[Bug 264435] bhyve: hda_write() can index (and jump) beyond end of array

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=264435

--- Comment #2 from commit-hook@FreeBSD.org ---
A commit in branch main references this bug:

URL:
https://cgit.FreeBSD.org/src/commit/?id=bfe8e339eb77910c2eb739b45aaa936148b33897

commit bfe8e339eb77910c2eb739b45aaa936148b33897
Author:     John Baldwin <jhb@FreeBSD.org>
AuthorDate: 2023-01-20 17:57:45 +0000
Commit:     John Baldwin <jhb@FreeBSD.org>
CommitDate: 2023-01-20 17:57:45 +0000

    bhyve: Fix a global buffer overread in the PCI hda device model.

    hda_write did not validate the relative register offset before using
    it as an index into the hda_set_reg_table array to lookup a function
    pointer to execute after updating the register's value.

    PR:             264435
    Reported by:    Robert Morris <rtm@lcs.mit.edu>
    Reviewed by:    corvink, markj, emaste
    Sponsored by:   The FreeBSD Foundation
    Differential Revision:  https://reviews.freebsd.org/D38127

 usr.sbin/bhyve/pci_hda.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

-- 
You are receiving this mail because:
You are the assignee for the bug.
You are on the CC list for the bug.