[Qemu-devel] [PATCH] hw/fmopl: Fix buffer access out-of-bounds errors

[Qemu-devel] [PATCH] hw/fmopl: Fix buffer access out-of-bounds errors

[Stefan Weil]

Index 75 is one too large for AR_TABLE[75], DR_TABLE[75].
This error was reported by cppcheck.

hw/fmopl.c:600: error: Buffer access out-of-bounds: OPL.AR_TABLE
hw/fmopl.c:601: error: Buffer access out-of-bounds: OPL.DR_TABLE

Fix this by limiting the access to the allowed range.
MultiArcadeMachineEmulator has newer versions of fmopl,
but using these requires more efforts.

Cc: Blue Swirl <blauwirbel@gmail.com>
Signed-off-by: Stefan Weil <weil@mail.berlios.de>
---
 hw/fmopl.c |    6 +++++-
 1 files changed, 5 insertions(+), 1 deletions(-)

diff --git a/hw/fmopl.c b/hw/fmopl.c
index 3df1806..d8a0f36 100644
--- a/hw/fmopl.c
+++ b/hw/fmopl.c
@@ -45,6 +45,10 @@
 #define PI 3.14159265358979323846
 #endif
 
+#ifndef ARRAY_SIZE
+#define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
+#endif
+
 /* -------------------- for debug --------------------- */
 /* #define OPL_OUTPUT_LOG */
 #ifdef OPL_OUTPUT_LOG
@@ -595,7 +599,7 @@ static void init_timetables( FM_OPL *OPL , int ARRATE , int DRRATE )
 		OPL->AR_TABLE[i] = rate / ARRATE;
 		OPL->DR_TABLE[i] = rate / DRRATE;
 	}
-	for (i = 60;i < 76;i++)
+	for (i = 60; i < ARRAY_SIZE(OPL->AR_TABLE); i++)
 	{
 		OPL->AR_TABLE[i] = EG_AED-1;
 		OPL->DR_TABLE[i] = OPL->DR_TABLE[60];
-- 
1.7.2.3

[Qemu-devel] [PATCH RESEND] hw/fmopl: Fix buffer access out-of-bounds errors

[Stefan Weil]

Index 75 is one too large for AR_TABLE[75], DR_TABLE[75].
This error was reported by cppcheck.

hw/fmopl.c:600: error: Buffer access out-of-bounds: OPL.AR_TABLE
hw/fmopl.c:601: error: Buffer access out-of-bounds: OPL.DR_TABLE

Fix this by limiting the access to the allowed range.
MultiArcadeMachineEmulator has newer versions of fmopl,
but using these requires more efforts.

Cc: Blue Swirl <blauwirbel@gmail.com>
Reviewed-by: malc <av1474@comtv.ru>
Signed-off-by: Stefan Weil <weil@mail.berlios.de>
---
 hw/fmopl.c |    6 +++++-
 1 files changed, 5 insertions(+), 1 deletions(-)

diff --git a/hw/fmopl.c b/hw/fmopl.c
index 3df1806..d8a0f36 100644
--- a/hw/fmopl.c
+++ b/hw/fmopl.c
@@ -45,6 +45,10 @@
 #define PI 3.14159265358979323846
 #endif
 
+#ifndef ARRAY_SIZE
+#define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
+#endif
+
 /* -------------------- for debug --------------------- */
 /* #define OPL_OUTPUT_LOG */
 #ifdef OPL_OUTPUT_LOG
@@ -595,7 +599,7 @@ static void init_timetables( FM_OPL *OPL , int ARRATE , int DRRATE )
 		OPL->AR_TABLE[i] = rate / ARRATE;
 		OPL->DR_TABLE[i] = rate / DRRATE;
 	}
-	for (i = 60;i < 76;i++)
+	for (i = 60; i < ARRAY_SIZE(OPL->AR_TABLE); i++)
 	{
 		OPL->AR_TABLE[i] = EG_AED-1;
 		OPL->DR_TABLE[i] = OPL->DR_TABLE[60];
-- 
1.7.2.3

[Qemu-devel] Re: [PATCH RESEND] hw/fmopl: Fix buffer access out-of-bounds errors

[Blue Swirl]

Thanks, applied.

On Sat, Mar 12, 2011 at 6:43 PM, Stefan Weil <weil@mail.berlios.de> wrote:
> Index 75 is one too large for AR_TABLE[75], DR_TABLE[75].
> This error was reported by cppcheck.
>
> hw/fmopl.c:600: error: Buffer access out-of-bounds: OPL.AR_TABLE
> hw/fmopl.c:601: error: Buffer access out-of-bounds: OPL.DR_TABLE
>
> Fix this by limiting the access to the allowed range.
> MultiArcadeMachineEmulator has newer versions of fmopl,
> but using these requires more efforts.
>
> Cc: Blue Swirl <blauwirbel@gmail.com>
> Reviewed-by: malc <av1474@comtv.ru>
> Signed-off-by: Stefan Weil <weil@mail.berlios.de>
> ---
>  hw/fmopl.c |    6 +++++-
>  1 files changed, 5 insertions(+), 1 deletions(-)
>
> diff --git a/hw/fmopl.c b/hw/fmopl.c
> index 3df1806..d8a0f36 100644
> --- a/hw/fmopl.c
> +++ b/hw/fmopl.c
> @@ -45,6 +45,10 @@
>  #define PI 3.14159265358979323846
>  #endif
>
> +#ifndef ARRAY_SIZE
> +#define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
> +#endif
> +
>  /* -------------------- for debug --------------------- */
>  /* #define OPL_OUTPUT_LOG */
>  #ifdef OPL_OUTPUT_LOG
> @@ -595,7 +599,7 @@ static void init_timetables( FM_OPL *OPL , int ARRATE , int DRRATE )
>                OPL->AR_TABLE[i] = rate / ARRATE;
>                OPL->DR_TABLE[i] = rate / DRRATE;
>        }
> -       for (i = 60;i < 76;i++)
> +       for (i = 60; i < ARRAY_SIZE(OPL->AR_TABLE); i++)
>        {
>                OPL->AR_TABLE[i] = EG_AED-1;
>                OPL->DR_TABLE[i] = OPL->DR_TABLE[60];
> --
> 1.7.2.3
>
>