| Message ID | 1346737552-2390-1-git-send-email-sw@weilnetz.de |
|---|---|
| State | Superseded |
| Headers | show |
Thanks Stefan. Ill apply this when i get back to swe in a couple of days. Cheers --- Sent from my phone On Sep 3, 2012 10:46 PM, "Stefan Weil" <sw@weilnetz.de> wrote: > Report from smatch: > > target-cris/translate.c:3464 cpu_dump_state(32) error: > buffer overflow 'env->sregs' 4 <= 255 > > sregs is declared 'uint32_t sregs[4][16]', so the first index must be > less than 4. > > Signed-off-by: Stefan Weil <sw@weilnetz.de> > --- > > I did not fix tabs, therefore checkpatch.pl reports an error. > > target-cris/translate.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/target-cris/translate.c b/target-cris/translate.c > index 1ad9ec7..34c0452 100644 > --- a/target-cris/translate.c > +++ b/target-cris/translate.c > @@ -3458,7 +3458,7 @@ void cpu_dump_state (CPUCRISState *env, FILE *f, > fprintf_function cpu_fprintf, > } > srs = env->pregs[PR_SRS]; > cpu_fprintf(f, "\nsupport function regs bank %x:\n", srs); > - if (srs < 256) { > + if (srs < 4) { > for (i = 0; i < 16; i++) { > cpu_fprintf(f, "s%2.2d=%8.8x ", > i, env->sregs[srs][i]); > -- > 1.7.10 > >
On Tue, Sep 04, 2012 at 07:45:52AM +0200, Stefan Weil wrote: > Report from smatch: > > target-cris/translate.c:3464 cpu_dump_state(32) error: > buffer overflow 'env->sregs' 4 <= 255 > > sregs is declared 'uint32_t sregs[4][16]', so the first index must be > less than 4. Hi Stefan, I think it would be better to use ARRAY_SIZE(env->sregs) instead of 4. The cris arch allows up to 256 sregs, but we only implement 4 at the moment. There are other uses of hardcoded 4 in the code that could be fixed aswell if you have time. Thanks, Edgar
diff --git a/target-cris/translate.c b/target-cris/translate.c index 1ad9ec7..34c0452 100644 --- a/target-cris/translate.c +++ b/target-cris/translate.c @@ -3458,7 +3458,7 @@ void cpu_dump_state (CPUCRISState *env, FILE *f, fprintf_function cpu_fprintf, } srs = env->pregs[PR_SRS]; cpu_fprintf(f, "\nsupport function regs bank %x:\n", srs); - if (srs < 256) { + if (srs < 4) { for (i = 0; i < 16; i++) { cpu_fprintf(f, "s%2.2d=%8.8x ", i, env->sregs[srs][i]);
Report from smatch: target-cris/translate.c:3464 cpu_dump_state(32) error: buffer overflow 'env->sregs' 4 <= 255 sregs is declared 'uint32_t sregs[4][16]', so the first index must be less than 4. Signed-off-by: Stefan Weil <sw@weilnetz.de> --- I did not fix tabs, therefore checkpatch.pl reports an error. target-cris/translate.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)