From: Stefan Hajnoczi <stefanha@gmail.com>
To: Anthony Liguori <aliguori@us.ibm.com>
Cc: Stefan Weil <sw@weilnetz.de>,
qemu-devel@nongnu.org, Stefan Hajnoczi <stefanha@gmail.com>
Subject: [Qemu-devel] [PATCH 04/14] cadence_uart: Fix buffer overflow
Date: Sun, 23 Sep 2012 11:00:10 +0100 [thread overview]
Message-ID: <1348394420-28298-5-git-send-email-stefanha@gmail.com> (raw)
In-Reply-To: <1348394420-28298-1-git-send-email-stefanha@gmail.com>
From: Stefan Weil <sw@weilnetz.de>
Report from smatch:
hw/cadence_uart.c:413 uart_read(13) error: buffer overflow 's->r' 18 <= 18
This fixes read access to s->r[R_MAX] which is behind the limits of s->r.
Signed-off-by: Stefan Weil <sw@weilnetz.de>
Signed-off-by: Stefan Hajnoczi <stefanha@gmail.com>
---
hw/cadence_uart.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/hw/cadence_uart.c b/hw/cadence_uart.c
index d98e531..f8afc4e 100644
--- a/hw/cadence_uart.c
+++ b/hw/cadence_uart.c
@@ -404,7 +404,7 @@ static uint64_t uart_read(void *opaque, target_phys_addr_t offset,
uint32_t c = 0;
offset >>= 2;
- if (offset > R_MAX) {
+ if (offset >= R_MAX) {
return 0;
} else if (offset == R_TX_RX) {
uart_read_rx_fifo(s, &c);
--
1.7.10.4
next prev parent reply other threads:[~2012-09-23 10:00 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-09-23 10:00 [Qemu-devel] [PULL 00/14] Trivial patches for 15 to 23 September 2012 Stefan Hajnoczi
2012-09-23 10:00 ` [Qemu-devel] [PATCH 01/14] target-i386: Allow tsc-frequency to be larger then 2.147G Stefan Hajnoczi
2012-09-23 10:00 ` [Qemu-devel] [PATCH 02/14] qemu-ga: Remove unreachable code after g_error Stefan Hajnoczi
2012-09-23 10:00 ` [Qemu-devel] [PATCH 03/14] qemu-sockets: Fix potential memory leak Stefan Hajnoczi
2012-09-23 10:00 ` Stefan Hajnoczi [this message]
2012-09-23 10:00 ` [Qemu-devel] [PATCH 05/14] lm4549: Fix buffer overflow Stefan Hajnoczi
2012-09-23 10:00 ` [Qemu-devel] [PATCH 06/14] ioh3420: Remove unreachable code Stefan Hajnoczi
2012-09-23 10:00 ` [Qemu-devel] [PATCH 07/14] pflash_cfi01: Fix warning caused by " Stefan Hajnoczi
2012-09-23 10:00 ` [Qemu-devel] [PATCH 08/14] dtrace backend: add function to reserved words Stefan Hajnoczi
2012-09-23 10:00 ` [Qemu-devel] [PATCH 09/14] curses: don't initialize curses when qemu is daemonized Stefan Hajnoczi
2012-09-23 10:00 ` [Qemu-devel] [PATCH 10/14] TextConsole: saturate escape parameter in TTY_STATE_CSI Stefan Hajnoczi
2012-09-23 10:00 ` [Qemu-devel] [PATCH 11/14] qemu-timer: simplify qemu_run_timers Stefan Hajnoczi
2012-09-23 10:00 ` [Qemu-devel] [PATCH 12/14] linux-user: Remove redundant null check and replace free by g_free Stefan Hajnoczi
2012-09-23 10:00 ` [Qemu-devel] [PATCH 13/14] net/socket: Fix compiler warning (regression for MinGW) Stefan Hajnoczi
2012-09-23 10:00 ` [Qemu-devel] [PATCH 14/14] w32: Always use standard instead of native format strings Stefan Hajnoczi
2012-09-25 23:26 ` [Qemu-devel] [PULL 00/14] Trivial patches for 15 to 23 September 2012 Anthony Liguori
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1348394420-28298-5-git-send-email-stefanha@gmail.com \
--to=stefanha@gmail.com \
--cc=aliguori@us.ibm.com \
--cc=qemu-devel@nongnu.org \
--cc=sw@weilnetz.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).