Re: [Qemu-devel] [PATCH v2] target-cris: Fix buffer overflow

["Edgar E. Iglesias" <edgar.iglesias@gmail.com>]

On Fri, Sep 07, 2012 at 10:36:08PM +0200, Stefan Weil wrote:
> Report from smatch:
> 
> target-cris/translate.c:3464 cpu_dump_state(32) error:
>  buffer overflow 'env->sregs' 4 <= 255
> 
> sregs is declared 'uint32_t sregs[4][16]', so the first index must be
> less than 4 or ARRAY_SIZE(env->sregs).

Thanks Stefan, applied





> 
> Signed-off-by: Stefan Weil <sw@weilnetz.de>
> ---
> 
> I did not fix tabs, therefore checkpatch.pl reports an error.
> 
> Changes in V2:
> 
> * Use ARRAY_SIZE (suggested by Edgar).
> 
>  target-cris/translate.c |    2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/target-cris/translate.c b/target-cris/translate.c
> index 1ad9ec7..34c0452 100644
> --- a/target-cris/translate.c
> +++ b/target-cris/translate.c
> @@ -3458,7 +3458,7 @@ void cpu_dump_state (CPUCRISState *env, FILE *f, fprintf_function cpu_fprintf,
>  	}
>  	srs = env->pregs[PR_SRS];
>  	cpu_fprintf(f, "\nsupport function regs bank %x:\n", srs);
> -	if (srs < 256) {
> +	if (srs < ARRAY_SIZE(env->sregs)) {
>  		for (i = 0; i < 16; i++) {
>  			cpu_fprintf(f, "s%2.2d=%8.8x ",
>  				    i, env->sregs[srs][i]);
> -- 
> 1.7.10
>