commit a2d4e44b485222a8972ea9e555b148148c655bb9
author ths <ths@c046a42c-6fe2-441c-8c8c-71466251a162> Sun Dec 10 23:20:45 2006 +0000
committer ths <ths@c046a42c-6fe2-441c-8c8c-71466251a162> Sun Dec 10 23:20:45 2006 +0000
tree d6219aadb052dd45d0eb65b042e4b35e9725de18
parent 3bcb80f1af107c25bf8c255f3ca88ac467f27a1a

Fix PCI config space overflow, by Herbert Xu.


git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@2238 c046a42c-6fe2-441c-8c8c-71466251a162

hw/pci.c

diff --git a/hw/pci.c b/hw/pci.c
index bc7c779..d8fcd7b 100644
--- a/hw/pci.c
+++ b/hw/pci.c
@@ -242,16 +242,23 @@
                                  uint32_t address, int len)
 {
     uint32_t val;
+
     switch(len) {
-    case 1:
-        val = d->config[address];
-        break;
-    case 2:
-        val = le16_to_cpu(*(uint16_t *)(d->config + address));
-        break;
     default:
     case 4:
-        val = le32_to_cpu(*(uint32_t *)(d->config + address));
+	if (address <= 0xfc) {
+	    val = le32_to_cpu(*(uint32_t *)(d->config + address));
+	    break;
+	}
+	/* fall through */
+    case 2:
+        if (address <= 0xfe) {
+	    val = le16_to_cpu(*(uint16_t *)(d->config + address));
+	    break;
+	}
+	/* fall through */
+    case 1:
+        val = d->config[address];
         break;
     }
     return val;
@@ -341,7 +348,8 @@
         if (can_write) {
             d->config[addr] = val;
         }
-        addr++;
+        if (++addr > 0xff)
+        	break;
         val >>= 8;
     }