fw_cfg: avoid calculating invalid current entry pointer
When calculating a pointer to the currently selected fw_cfg item, the following is used: FWCfgEntry *e = &s->entries[arch][s->cur_entry & FW_CFG_ENTRY_MASK]; When s->cur_entry is FW_CFG_INVALID, we are calculating the address of a non-existent element in s->entries[arch][...], which is undefined. This patch ensures the resulting entry pointer is set to NULL whenever s->cur_entry is FW_CFG_INVALID. Reported-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Signed-off-by: Gabriel Somlo <somlo@cmu.edu> Message-id: 1446733972-1602-5-git-send-email-somlo@cmu.edu Cc: Marc Marí <markmb@redhat.com> Signed-off-by: Gabriel Somlo <somlo@cmu.edu> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
This commit is contained in:
parent
3f8752b4e5
commit
66f8fd9dda
|
@ -277,7 +277,8 @@ static int fw_cfg_select(FWCfgState *s, uint16_t key)
|
||||||
static uint8_t fw_cfg_read(FWCfgState *s)
|
static uint8_t fw_cfg_read(FWCfgState *s)
|
||||||
{
|
{
|
||||||
int arch = !!(s->cur_entry & FW_CFG_ARCH_LOCAL);
|
int arch = !!(s->cur_entry & FW_CFG_ARCH_LOCAL);
|
||||||
FWCfgEntry *e = &s->entries[arch][s->cur_entry & FW_CFG_ENTRY_MASK];
|
FWCfgEntry *e = (s->cur_entry == FW_CFG_INVALID) ? NULL :
|
||||||
|
&s->entries[arch][s->cur_entry & FW_CFG_ENTRY_MASK];
|
||||||
uint8_t ret;
|
uint8_t ret;
|
||||||
|
|
||||||
if (s->cur_entry == FW_CFG_INVALID || !e->data || s->cur_offset >= e->len)
|
if (s->cur_entry == FW_CFG_INVALID || !e->data || s->cur_offset >= e->len)
|
||||||
|
@ -342,7 +343,8 @@ static void fw_cfg_dma_transfer(FWCfgState *s)
|
||||||
}
|
}
|
||||||
|
|
||||||
arch = !!(s->cur_entry & FW_CFG_ARCH_LOCAL);
|
arch = !!(s->cur_entry & FW_CFG_ARCH_LOCAL);
|
||||||
e = &s->entries[arch][s->cur_entry & FW_CFG_ENTRY_MASK];
|
e = (s->cur_entry == FW_CFG_INVALID) ? NULL :
|
||||||
|
&s->entries[arch][s->cur_entry & FW_CFG_ENTRY_MASK];
|
||||||
|
|
||||||
if (dma.control & FW_CFG_DMA_CTL_READ) {
|
if (dma.control & FW_CFG_DMA_CTL_READ) {
|
||||||
read = 1;
|
read = 1;
|
||||||
|
|
Loading…
Reference in a new issue