[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 20/21] xilinx_spips: Correct usage of an uninitialize
From: |
Peter Maydell |
Subject: |
[Qemu-devel] [PULL 20/21] xilinx_spips: Correct usage of an uninitialized local variable |
Date: |
Thu, 25 Jan 2018 13:43:28 +0000 |
From: Francisco Iglesias <address@hidden>
Coverity found that the variable tx_rx in the function
xilinx_spips_flush_txfifo was being used uninitialized (CID 1383841). This
patch corrects this by always initializing tx_rx to zeros.
Signed-off-by: Francisco Iglesias <address@hidden>
Message-id: address@hidden
Reviewed-by: Peter Maydell <address@hidden>
Signed-off-by: Peter Maydell <address@hidden>
---
hw/ssi/xilinx_spips.c | 18 +++++++++++++++++-
1 file changed, 17 insertions(+), 1 deletion(-)
diff --git a/hw/ssi/xilinx_spips.c b/hw/ssi/xilinx_spips.c
index 85c5d0c..8af36ca 100644
--- a/hw/ssi/xilinx_spips.c
+++ b/hw/ssi/xilinx_spips.c
@@ -210,6 +210,9 @@
#define SNOOP_NONE 0xEE
#define SNOOP_STRIPING 0
+#define MIN_NUM_BUSSES 1
+#define MAX_NUM_BUSSES 2
+
static inline int num_effective_busses(XilinxSPIPS *s)
{
return (s->regs[R_LQSPI_CFG] & LQSPI_CFG_SEP_BUS &&
@@ -573,7 +576,7 @@ static void xilinx_spips_flush_txfifo(XilinxSPIPS *s)
for (;;) {
int i;
uint8_t tx = 0;
- uint8_t tx_rx[num_effective_busses(s)];
+ uint8_t tx_rx[MAX_NUM_BUSSES] = { 0 };
uint8_t dummy_cycles = 0;
uint8_t addr_length;
@@ -1221,6 +1224,19 @@ static void xilinx_spips_realize(DeviceState *dev, Error
**errp)
DB_PRINT_L(0, "realized spips\n");
+ if (s->num_busses > MAX_NUM_BUSSES) {
+ error_setg(errp,
+ "requested number of SPI busses %u exceeds maximum %d",
+ s->num_busses, MAX_NUM_BUSSES);
+ return;
+ }
+ if (s->num_busses < MIN_NUM_BUSSES) {
+ error_setg(errp,
+ "requested number of SPI busses %u is below minimum %d",
+ s->num_busses, MIN_NUM_BUSSES);
+ return;
+ }
+
s->spi = g_new(SSIBus *, s->num_busses);
for (i = 0; i < s->num_busses; ++i) {
char bus_name[16];
--
2.7.4
- [Qemu-devel] [PULL 04/21] target/arm: Use pointers in crypto helpers, (continued)
- [Qemu-devel] [PULL 04/21] target/arm: Use pointers in crypto helpers, Peter Maydell, 2018/01/25
- [Qemu-devel] [PULL 11/21] target/arm: Move cpu_get_tb_cpu_state out of line, Peter Maydell, 2018/01/25
- [Qemu-devel] [PULL 15/21] hw/intc/arm_gic: Fix C_RPR value on idle priority, Peter Maydell, 2018/01/25
- [Qemu-devel] [PULL 16/21] hw/intc/arm_gic: Fix group priority computation for group 1 IRQs, Peter Maydell, 2018/01/25
- [Qemu-devel] [PULL 18/21] hw/arm/virt: Check that the CPU realize method succeeded, Peter Maydell, 2018/01/25
- [Qemu-devel] [PULL 05/21] target/arm: Use pointers in neon zip/uzp helpers, Peter Maydell, 2018/01/25
- [Qemu-devel] [PULL 19/21] sdhci: fix a NULL pointer dereference due to uninitialized AddresSpace object, Peter Maydell, 2018/01/25
- [Qemu-devel] [PULL 21/21] pl110: Implement vertical compare/next base interrupts, Peter Maydell, 2018/01/25
- [Qemu-devel] [PULL 17/21] hw/intc/arm_gic: Fix the NS view of C_BPR when C_CTRL.CBPR is 1, Peter Maydell, 2018/01/25
- [Qemu-devel] [PULL 14/21] hw/intc/arm_gic: Prevent the GIC from signaling an IRQ when it's "active and pending", Peter Maydell, 2018/01/25
- [Qemu-devel] [PULL 20/21] xilinx_spips: Correct usage of an uninitialized local variable,
Peter Maydell <=
- Re: [Qemu-devel] [PULL 00/21] target-arm queue, no-reply, 2018/01/25
- Re: [Qemu-devel] [PULL 00/21] target-arm queue, Peter Maydell, 2018/01/25