sdhci.c: Limit the maximum block size
It is possible for the guest to set an invalid block
size which is larger then the fifo_buffer[] array. This
could cause a buffer overflow.
To avoid this limit the maximum size of the blksize variable.
Signed-off-by: Alistair Francis <[email protected]>
Reported-by: Intel Security ATR <[email protected]>
Reviewed-by: Stefan Hajnoczi <[email protected]>
Reviewed-by: Peter Crosthwaite <[email protected]>
Message-id:
abe4c51f513290bbb85d1ee271cb1a3d463d7561.
1444067470[email protected]
Suggested-by: Igor Mitsyanko <[email protected]>
Reported-by: Intel Security ATR <[email protected]>
Reviewed-by: Stefan Hajnoczi <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>