haraldwolff/qemu-patch-raspberry4
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

ppc405_uc: Fix buffer overflow

Browse source 
Report from smatch:

ppc405_uc.c:209 dcr_read_pob(12) error: buffer overflow 'pob->besr' 2 <= 2
ppc405_uc.c:232 dcr_write_pob(12) error: buffer overflow 'pob->besr' 2 <= 2

The old code reads and writes besr[POB0_BESR1 - POB0_BESR0] or besr[2]
which is one too much.

Signed-off-by: Stefan Weil <sw@weilnetz.de>
Reviewed-by: Andreas Färber <afaerber@suse.de>
Signed-off-by: Alexander Graf <agraf@suse.de>
This commit is contained in:
Stefan Weil 2012-08-31 22:21:21 +02:00 committed by Alexander Graf
parent ace9a2cbac
commit 5a1972c847
1 changed files with 11 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
hw/ppc405_uc.c
View file

@ -191,7 +191,8 @@ enum {
typedef struct ppc4xx_pob_t ppc4xx_pob_t;
struct ppc4xx_pob_t {
uint32_t bear;
uint32_t besr[2];
uint32_t besr0;
uint32_t besr1;
};
static uint32_t dcr_read_pob (void *opaque, int dcrn)
@ -205,8 +206,10 @@ static uint32_t dcr_read_pob (void *opaque, int dcrn)
ret = pob->bear;
break;
case POB0_BESR0:
ret = pob->besr0;
break;
case POB0_BESR1:
ret = pob->besr[dcrn - POB0_BESR0];
ret = pob->besr1;
break;
default:
/* Avoid gcc warning */
@ -227,9 +230,12 @@ static void dcr_write_pob (void *opaque, int dcrn, uint32_t val)
/* Read only */
break;
case POB0_BESR0:
/* Write-clear */
pob->besr0 &= ~val;
break;
case POB0_BESR1:
/* Write-clear */
pob->besr[dcrn - POB0_BESR0] &= ~val;
pob->besr1 &= ~val;
break;
}
}
@ -241,8 +247,8 @@ static void ppc4xx_pob_reset (void *opaque)
pob = opaque;
/* No error */
pob->bear = 0x00000000;
pob->besr[0] = 0x0000000;
pob->besr[1] = 0x0000000;
pob->besr0 = 0x0000000;
pob->besr1 = 0x0000000;
}
static void ppc4xx_pob_init(CPUPPCState *env)