[Qemu-devel] [PATCH] target-cris: Fix buffer overflow

[Qemu-devel] [PATCH] target-cris: Fix buffer overflow

[Stefan Weil]

Report from smatch:

target-cris/translate.c:3464 cpu_dump_state(32) error:
 buffer overflow 'env->sregs' 4 <= 255

sregs is declared 'uint32_t sregs[4][16]', so the first index must be
less than 4.

Signed-off-by: Stefan Weil <sw@weilnetz.de>
---

I did not fix tabs, therefore checkpatch.pl reports an error.

 target-cris/translate.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target-cris/translate.c b/target-cris/translate.c
index 1ad9ec7..34c0452 100644
--- a/target-cris/translate.c
+++ b/target-cris/translate.c
@@ -3458,7 +3458,7 @@ void cpu_dump_state (CPUCRISState *env, FILE *f, fprintf_function cpu_fprintf,
 	}
 	srs = env->pregs[PR_SRS];
 	cpu_fprintf(f, "\nsupport function regs bank %x:\n", srs);
-	if (srs < 256) {
+	if (srs < 4) {
 		for (i = 0; i < 16; i++) {
 			cpu_fprintf(f, "s%2.2d=%8.8x ",
 				    i, env->sregs[srs][i]);
-- 
1.7.10

Re: [Qemu-devel] [PATCH] target-cris: Fix buffer overflow

[Edgar E. Iglesias]

[-- Attachment #1: Type: text/plain, Size: 1209 bytes --]

Thanks Stefan. Ill apply this when i get back to swe in a couple of days.

Cheers

---
Sent from my phone
On Sep 3, 2012 10:46 PM, "Stefan Weil" <sw@weilnetz.de> wrote:

> Report from smatch:
>
> target-cris/translate.c:3464 cpu_dump_state(32) error:
>  buffer overflow 'env->sregs' 4 <= 255
>
> sregs is declared 'uint32_t sregs[4][16]', so the first index must be
> less than 4.
>
> Signed-off-by: Stefan Weil <sw@weilnetz.de>
> ---
>
> I did not fix tabs, therefore checkpatch.pl reports an error.
>
>  target-cris/translate.c |    2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/target-cris/translate.c b/target-cris/translate.c
> index 1ad9ec7..34c0452 100644
> --- a/target-cris/translate.c
> +++ b/target-cris/translate.c
> @@ -3458,7 +3458,7 @@ void cpu_dump_state (CPUCRISState *env, FILE *f,
> fprintf_function cpu_fprintf,
>         }
>         srs = env->pregs[PR_SRS];
>         cpu_fprintf(f, "\nsupport function regs bank %x:\n", srs);
> -       if (srs < 256) {
> +       if (srs < 4) {
>                 for (i = 0; i < 16; i++) {
>                         cpu_fprintf(f, "s%2.2d=%8.8x ",
>                                     i, env->sregs[srs][i]);
> --
> 1.7.10
>
>

[-- Attachment #2: Type: text/html, Size: 1709 bytes --]

Re: [Qemu-devel] [PATCH] target-cris: Fix buffer overflow

[Edgar E. Iglesias]

On Tue, Sep 04, 2012 at 07:45:52AM +0200, Stefan Weil wrote:
> Report from smatch:
> 
> target-cris/translate.c:3464 cpu_dump_state(32) error:
>  buffer overflow 'env->sregs' 4 <= 255
> 
> sregs is declared 'uint32_t sregs[4][16]', so the first index must be
> less than 4.


Hi Stefan,

I think it would be better to use ARRAY_SIZE(env->sregs) instead of 4.

The cris arch allows up to 256 sregs, but we only implement 4
at the moment. There are other uses of hardcoded 4 in the code
that could be fixed aswell if you have time.

Thanks,
Edgar