[Top][All Lists]
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH 24/34] ppc405_uc: Fix buffer overflow
From: |
Alexander Graf |
Subject: |
[Qemu-devel] [PATCH 24/34] ppc405_uc: Fix buffer overflow |
Date: |
Thu, 4 Oct 2012 15:56:46 +0200 |
From: Stefan Weil <address@hidden>
Report from smatch:
ppc405_uc.c:209 dcr_read_pob(12) error: buffer overflow 'pob->besr' 2 <= 2
ppc405_uc.c:232 dcr_write_pob(12) error: buffer overflow 'pob->besr' 2 <= 2
The old code reads and writes besr[POB0_BESR1 - POB0_BESR0] or besr[2]
which is one too much.
Signed-off-by: Stefan Weil <address@hidden>
Reviewed-by: Andreas Färber <address@hidden>
Signed-off-by: Alexander Graf <address@hidden>
---
hw/ppc405_uc.c | 16 +++++++++++-----
1 files changed, 11 insertions(+), 5 deletions(-)
diff --git a/hw/ppc405_uc.c b/hw/ppc405_uc.c
index 89e5013..b52ab2f 100644
--- a/hw/ppc405_uc.c
+++ b/hw/ppc405_uc.c
@@ -191,7 +191,8 @@ enum {
typedef struct ppc4xx_pob_t ppc4xx_pob_t;
struct ppc4xx_pob_t {
uint32_t bear;
- uint32_t besr[2];
+ uint32_t besr0;
+ uint32_t besr1;
};
static uint32_t dcr_read_pob (void *opaque, int dcrn)
@@ -205,8 +206,10 @@ static uint32_t dcr_read_pob (void *opaque, int dcrn)
ret = pob->bear;
break;
case POB0_BESR0:
+ ret = pob->besr0;
+ break;
case POB0_BESR1:
- ret = pob->besr[dcrn - POB0_BESR0];
+ ret = pob->besr1;
break;
default:
/* Avoid gcc warning */
@@ -227,9 +230,12 @@ static void dcr_write_pob (void *opaque, int dcrn,
uint32_t val)
/* Read only */
break;
case POB0_BESR0:
+ /* Write-clear */
+ pob->besr0 &= ~val;
+ break;
case POB0_BESR1:
/* Write-clear */
- pob->besr[dcrn - POB0_BESR0] &= ~val;
+ pob->besr1 &= ~val;
break;
}
}
@@ -241,8 +247,8 @@ static void ppc4xx_pob_reset (void *opaque)
pob = opaque;
/* No error */
pob->bear = 0x00000000;
- pob->besr[0] = 0x0000000;
- pob->besr[1] = 0x0000000;
+ pob->besr0 = 0x0000000;
+ pob->besr1 = 0x0000000;
}
static void ppc4xx_pob_init(CPUPPCState *env)
--
1.6.0.2
- [Qemu-devel] [PATCH 14/34] pseries: Clear TCE and signal state when resetting PAPR VIO devices, (continued)
- [Qemu-devel] [PATCH 14/34] pseries: Clear TCE and signal state when resetting PAPR VIO devices, Alexander Graf, 2012/10/04
- [Qemu-devel] [PATCH 17/34] pseries: Small cleanup to H_CEDE implementation, Alexander Graf, 2012/10/04
- [Qemu-devel] [PATCH 12/34] pseries: Use new method to correct reset sequence, Alexander Graf, 2012/10/04
- [Qemu-devel] [PATCH 10/34] ppc: Make kvm_arch_put_registers() put *all* the registers, Alexander Graf, 2012/10/04
- [Qemu-devel] [PATCH 18/34] pseries: Remove C bitfields from xics code, Alexander Graf, 2012/10/04
- [Qemu-devel] [PATCH 22/34] pseries: Fix semantics of RTAS int-on, int-off and set-xive functions, Alexander Graf, 2012/10/04
- [Qemu-devel] [PATCH 19/34] pseries: Remove XICS irq type enum type, Alexander Graf, 2012/10/04
- [Qemu-devel] [PATCH 21/34] pseries: Rework implementation of TCE bypass, Alexander Graf, 2012/10/04
- [Qemu-devel] [PATCH 13/34] pseries: Add support for new KVM hash table control call, Alexander Graf, 2012/10/04
- [Qemu-devel] [PATCH 20/34] pseries: Remove never used flags field from spapr vio devices, Alexander Graf, 2012/10/04
- [Qemu-devel] [PATCH 24/34] ppc405_uc: Fix buffer overflow,
Alexander Graf <=
- [Qemu-devel] [PATCH 31/34] PPC: e500: increase DTC_LOAD_PAD, Alexander Graf, 2012/10/04
- [Qemu-devel] [PATCH 26/34] pseries: Set hash table size based on RAM size, Alexander Graf, 2012/10/04
- [Qemu-devel] [PATCH 25/34] pseries: Remove unnecessary locking from PAPR hash table hcalls, Alexander Graf, 2012/10/04
- [Qemu-devel] [PATCH 27/34] target-ppc: Remove unused power_mode field from cpu state, Alexander Graf, 2012/10/04
- [Qemu-devel] [PATCH 23/34] target-ppc: KVM: Fix some kernel version edge cases for kvmppc_reset_htab(), Alexander Graf, 2012/10/04
- [Qemu-devel] [PATCH 28/34] target-ppc: Extend FPU state for newer POWER CPUs, Alexander Graf, 2012/10/04
- [Qemu-devel] [PATCH 32/34] PPC: e500: calculate initrd_base like dt_base, Alexander Graf, 2012/10/04
- [Qemu-devel] [PATCH 34/34] ppc/pseries: Reset VPA registration on CPU reset, Alexander Graf, 2012/10/04
- [Qemu-devel] [PATCH 33/34] pseries: Don't test for MSR_PR for hypercalls under KVM, Alexander Graf, 2012/10/04
- [Qemu-devel] [PATCH 29/34] fdt: move dumpdtb interpretation code to device_tree.c, Alexander Graf, 2012/10/04