qemu-devel
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Qemu-devel] [PATCH] pseries: Fix possible out-of-bounds error


From: Stefan Weil
Subject: Re: [Qemu-devel] [PATCH] pseries: Fix possible out-of-bounds error
Date: Mon, 28 Nov 2011 18:53:33 +0100
User-agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.16) Gecko/20111110 Iceowl/1.0b1 Icedove/3.0.11

Am 21.11.2011 20:25, schrieb Stefan Weil:
PCI_NUM_REGIONS is 7, ARRAY_SIZE(bars) is 6. Either bars must be
extended by a 7th array element, or the loop which reads bars[i]
must terminate before it tries to read bars[6].

For dev->io_regions[6].size == 0, the old code also works,
but it is not obvious whether this is always true.

This bug was detected by cppcheck.

Cc: David Gibson<address@hidden>
Signed-off-by: Stefan Weil<address@hidden>
---
  hw/spapr_pci.c |    2 +-
  1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/hw/spapr_pci.c b/hw/spapr_pci.c
index 7162588..cefde38 100644
--- a/hw/spapr_pci.c
+++ b/hw/spapr_pci.c
@@ -454,7 +454,7 @@ int spapr_populate_pci_devices(sPAPRPHBState *phb,
          reg[0].size = 0;

          n = 0;
-        for (i = 0; i<  PCI_NUM_REGIONS; ++i) {
+        for (i = 0; i<  PCI_NUM_REGIONS&&  i<  ARRAY_SIZE(bars); ++i) {
              if (0 == dev->io_regions[i].size) {
                  continue;
              }

Ping? Can this be fixed in QEMU 1.0?



reply via email to

[Prev in Thread] Current Thread [Next in Thread]