From patchwork Tue Apr 4 07:45:06 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Feng Jiang X-Patchwork-Id: 1765004 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=nongnu.org (client-ip=209.51.188.17; helo=lists.gnu.org; envelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org; receiver=) Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4PrV8P3F40z1yZQ for ; Wed, 5 Apr 2023 00:12:36 +1000 (AEST) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1pjhNc-0002Xk-BF; Tue, 04 Apr 2023 10:11:24 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1pjbMN-0000r7-1J; Tue, 04 Apr 2023 03:45:44 -0400 Received: from mailgw.kylinos.cn ([124.126.103.232]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1pjbMI-0007VI-Jg; Tue, 04 Apr 2023 03:45:42 -0400 X-UUID: 7109e155d15f4e1d9b90988a8f9b9732-20230404 X-CID-O-RULE: Release_Ham X-CID-RULE: Release_Ham X-CID-O-INFO: VERSION:1.1.22, REQID:c230e7ff-7383-4e37-9e3d-befd4212d63f, IP:15, URL:0,TC:0,Content:0,EDM:25,RT:0,SF:-5,FILE:0,BULK:0,RULE:Release_Ham,ACTI ON:release,TS:35 X-CID-INFO: VERSION:1.1.22, REQID:c230e7ff-7383-4e37-9e3d-befd4212d63f, IP:15, UR L:0,TC:0,Content:0,EDM:25,RT:0,SF:-5,FILE:0,BULK:0,RULE:Release_Ham,ACTION :release,TS:35 X-CID-META: VersionHash:120426c, CLOUDID:fcfcc3f7-ddba-41c3-91d9-10eeade8eac7, B ulkID:2304041545233UXU9CEP,BulkQuantity:0,Recheck:0,SF:38|24|17|19|44|102, TC:nil,Content:0,EDM:5,IP:-2,URL:0,File:nil,Bulk:nil,QS:nil,BEC:nil,COL:0, OSI:0,OSA:0,AV:0 X-CID-BVR: 0,NGT X-CID-BAS: 0,NGT,0,_ X-UUID: 7109e155d15f4e1d9b90988a8f9b9732-20230404 X-User: jiangfeng@kylinos.cn Received: from localhost.localdomain [(116.128.244.169)] by mailgw (envelope-from ) (Generic MTA with TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 256/256) with ESMTP id 631463944; Tue, 04 Apr 2023 15:45:21 +0800 From: Feng Jiang To: i.mitsyanko@gmail.com, peter.maydell@linaro.org Cc: qemu-arm@nongnu.org, qemu-devel@nongnu.org, Feng Jiang Subject: [PATCH] exynos: Fix out-of-bounds access in exynos4210_gcomp_find Date: Tue, 4 Apr 2023 15:45:06 +0800 Message-Id: <20230404074506.112615-1-jiangfeng@kylinos.cn> X-Mailer: git-send-email 2.39.2 MIME-Version: 1.0 Received-SPF: pass client-ip=124.126.103.232; envelope-from=jiangfeng@kylinos.cn; helo=mailgw.kylinos.cn X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-Mailman-Approved-At: Tue, 04 Apr 2023 10:11:21 -0400 X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org When 'res' equals -1, the array 's->g_timer.reg.comp[]' is accessed out of bounds. Signed-off-by: Feng Jiang --- hw/timer/exynos4210_mct.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/hw/timer/exynos4210_mct.c b/hw/timer/exynos4210_mct.c index c17b247da3..446bbd2b96 100644 --- a/hw/timer/exynos4210_mct.c +++ b/hw/timer/exynos4210_mct.c @@ -480,11 +480,14 @@ static int32_t exynos4210_gcomp_find(Exynos4210MCTState *s) res = min_comp_i; } - DPRINTF("found comparator %d: comp 0x%llx distance 0x%llx, gfrc 0x%llx\n", - res, - s->g_timer.reg.comp[res], - distance_min, - gfrc); + if (res >= 0) { + DPRINTF("found comparator %d: " + "comp 0x%llx distance 0x%llx, gfrc 0x%llx\n", + res, + s->g_timer.reg.comp[res], + distance_min, + gfrc); + } return res; }