From patchwork Tue Sep 4 05:35:57 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stefan Weil X-Patchwork-Id: 181494 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (Client did not present a certificate) by ozlabs.org (Postfix) with ESMTPS id 520652C0091 for ; Tue, 4 Sep 2012 15:36:12 +1000 (EST) Received: from localhost ([::1]:40793 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1T8lo1-00074E-Tz for incoming@patchwork.ozlabs.org; Tue, 04 Sep 2012 01:36:09 -0400 Received: from eggs.gnu.org ([208.118.235.92]:34453) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1T8lnv-00073y-42 for qemu-devel@nongnu.org; Tue, 04 Sep 2012 01:36:03 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1T8lnu-00034o-36 for qemu-devel@nongnu.org; Tue, 04 Sep 2012 01:36:02 -0400 Received: from v220110690675601.yourvserver.net ([78.47.199.172]:43777) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1T8lnt-00034J-St for qemu-devel@nongnu.org; Tue, 04 Sep 2012 01:36:02 -0400 Received: from localhost (v220110690675601.yourvserver.net.local [127.0.0.1]) by v220110690675601.yourvserver.net (Postfix) with ESMTP id 72D217280029; Tue, 4 Sep 2012 07:36:00 +0200 (CEST) X-Virus-Scanned: Debian amavisd-new at weilnetz.de Received: from v220110690675601.yourvserver.net ([127.0.0.1]) by localhost (v220110690675601.yourvserver.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CPfxmzVn5g9Y; Tue, 4 Sep 2012 07:36:00 +0200 (CEST) Received: by v220110690675601.yourvserver.net (Postfix, from userid 1000) id 13769728002B; Tue, 4 Sep 2012 07:36:00 +0200 (CEST) From: Stefan Weil To: Paul Brook , Peter Maydell Date: Tue, 4 Sep 2012 07:35:57 +0200 Message-Id: <1346736957-24745-1-git-send-email-sw@weilnetz.de> X-Mailer: git-send-email 1.7.10 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.6 (newer, 3) X-Received-From: 78.47.199.172 Cc: Stefan Weil , qemu-devel@nongnu.org Subject: [Qemu-devel] [PATCH] target-arm: Fix potential buffer overflow X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Report from smatch: target-arm/helper.c:651 arm946_prbs_read(6) error: buffer overflow 'env->cp15.c6_region' 8 <= 8 target-arm/helper.c:661 arm946_prbs_write(6) error: buffer overflow 'env->cp15.c6_region' 8 <= 8 c7_region is an array with 8 elements, so the index must be less than 8. Signed-off-by: Stefan Weil Reviewed-by: Peter Maydell --- target-arm/helper.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/target-arm/helper.c b/target-arm/helper.c index dceaa95..e27df96 100644 --- a/target-arm/helper.c +++ b/target-arm/helper.c @@ -645,7 +645,7 @@ static int pmsav5_insn_ap_read(CPUARMState *env, const ARMCPRegInfo *ri, static int arm946_prbs_read(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t *value) { - if (ri->crm > 8) { + if (ri->crm >= 8) { return EXCP_UDEF; } *value = env->cp15.c6_region[ri->crm]; @@ -655,7 +655,7 @@ static int arm946_prbs_read(CPUARMState *env, const ARMCPRegInfo *ri, static int arm946_prbs_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) { - if (ri->crm > 8) { + if (ri->crm >= 8) { return EXCP_UDEF; } env->cp15.c6_region[ri->crm] = value;