diff options
| author | Stefan Weil <sw@weilnetz.de> | 2012-08-31 22:21:21 +0200 |
|---|---|---|
| committer | Alexander Graf <agraf@suse.de> | 2012-10-04 15:54:18 +0200 |
| commit | 5a1972c8472fafd519a68b689fdcaf33ec857945 (patch) | |
| tree | 2f940df27461b514676b6316f7fcd11d3e2d14cb | |
| parent | ace9a2cbac9b2949aadc176ffa83a1d2a0873e2c (diff) | |
| download | qemu-kvm-5a1972c8472fafd519a68b689fdcaf33ec857945.tar.gz | |
ppc405_uc: Fix buffer overflow
Report from smatch:
ppc405_uc.c:209 dcr_read_pob(12) error: buffer overflow 'pob->besr' 2 <= 2
ppc405_uc.c:232 dcr_write_pob(12) error: buffer overflow 'pob->besr' 2 <= 2
The old code reads and writes besr[POB0_BESR1 - POB0_BESR0] or besr[2]
which is one too much.
Signed-off-by: Stefan Weil <sw@weilnetz.de>
Reviewed-by: Andreas Färber <afaerber@suse.de>
Signed-off-by: Alexander Graf <agraf@suse.de>
| -rw-r--r-- | hw/ppc405_uc.c | 16 |
1 files changed, 11 insertions, 5 deletions
diff --git a/hw/ppc405_uc.c b/hw/ppc405_uc.c index 89e5013b577..b52ab2f1792 100644 --- a/hw/ppc405_uc.c +++ b/hw/ppc405_uc.c @@ -191,7 +191,8 @@ enum { typedef struct ppc4xx_pob_t ppc4xx_pob_t; struct ppc4xx_pob_t { uint32_t bear; - uint32_t besr[2]; + uint32_t besr0; + uint32_t besr1; }; static uint32_t dcr_read_pob (void *opaque, int dcrn) @@ -205,8 +206,10 @@ static uint32_t dcr_read_pob (void *opaque, int dcrn) ret = pob->bear; break; case POB0_BESR0: + ret = pob->besr0; + break; case POB0_BESR1: - ret = pob->besr[dcrn - POB0_BESR0]; + ret = pob->besr1; break; default: /* Avoid gcc warning */ @@ -227,9 +230,12 @@ static void dcr_write_pob (void *opaque, int dcrn, uint32_t val) /* Read only */ break; case POB0_BESR0: + /* Write-clear */ + pob->besr0 &= ~val; + break; case POB0_BESR1: /* Write-clear */ - pob->besr[dcrn - POB0_BESR0] &= ~val; + pob->besr1 &= ~val; break; } } @@ -241,8 +247,8 @@ static void ppc4xx_pob_reset (void *opaque) pob = opaque; /* No error */ pob->bear = 0x00000000; - pob->besr[0] = 0x0000000; - pob->besr[1] = 0x0000000; + pob->besr0 = 0x0000000; + pob->besr1 = 0x0000000; } static void ppc4xx_pob_init(CPUPPCState *env) |