From: "Andreas Färber" <afaerber@suse.de>
To: qemu-devel@nongnu.org
Cc: "Igor Mammedov" <imammedo@redhat.com>,
"Andreas Färber" <afaerber@suse.de>
Subject: [Qemu-devel] [PULL 06/17] target-i386: cpu: Fix potential buffer overrun in get_register_name_32()
Date: Thu, 13 Jun 2013 02:45:18 +0200 [thread overview]
Message-ID: <1371084329-814-7-git-send-email-afaerber@suse.de> (raw)
In-Reply-To: <1371084329-814-1-git-send-email-afaerber@suse.de>
From: Igor Mammedov <imammedo@redhat.com>
Spotted by Coverity,
x86_reg_info_32[] is CPU_NB_REGS32 elements long, so accessing
x86_reg_info_32[CPU_NB_REGS32] will be one element off array.
Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: liguang <lig.fnst@cn.fujitsu.com>
Reviewed by: Jesse Larrew <jlarrew@linux.vnet.ibm.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>
---
target-i386/cpu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/target-i386/cpu.c b/target-i386/cpu.c
index 762baad..4b2da0d 100644
--- a/target-i386/cpu.c
+++ b/target-i386/cpu.c
@@ -221,7 +221,7 @@ X86RegisterInfo32 x86_reg_info_32[CPU_NB_REGS32] = {
const char *get_register_name_32(unsigned int reg)
{
- if (reg > CPU_NB_REGS32) {
+ if (reg >= CPU_NB_REGS32) {
return NULL;
}
return x86_reg_info_32[reg].name;
--
1.8.1.4
next prev parent reply other threads:[~2013-06-13 0:45 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-06-13 0:45 [Qemu-devel] [PULL 00/17] QOM CPUState patch queue 2013-06-12 Andreas Färber
2013-06-13 0:45 ` [Qemu-devel] [PULL 01/17] dump: Move stubs into libqemustub.a Andreas Färber
2013-06-13 0:45 ` [Qemu-devel] [PULL 02/17] pc: Fix crash when attempting to hotplug CPU with negative ID Andreas Färber
2013-06-13 0:45 ` [Qemu-devel] [PULL 03/17] pc: Create pc-*-1.6 machine-types Andreas Färber
2013-06-13 0:45 ` [Qemu-devel] [PULL 04/17] target-i386: Update model values on Conroe/Penryn/Nehalem CPU models Andreas Färber
2013-06-13 0:45 ` [Qemu-devel] [PULL 05/17] target-i386: Set level=4 on Conroe/Penryn/Nehalem Andreas Färber
2013-06-13 0:45 ` Andreas Färber [this message]
2013-06-13 0:45 ` [Qemu-devel] [PULL 07/17] monitor: Simplify do_inject_mce() with qemu_get_cpu() Andreas Färber
2013-06-13 0:45 ` [Qemu-devel] [PULL 08/17] cpu: Turn cpu_paging_enabled() into a CPUState hook Andreas Färber
2013-06-13 0:45 ` [Qemu-devel] [PULL 09/17] memory_mapping: Move MemoryMappingList typedef to qemu/typedefs.h Andreas Färber
2013-06-13 0:45 ` [Qemu-devel] [PULL 10/17] cpu: Turn cpu_get_memory_mapping() into a CPUState hook Andreas Färber
2013-06-13 0:45 ` [Qemu-devel] [PULL 11/17] memory_mapping: Drop qemu_get_memory_mapping() stub Andreas Färber
2013-06-13 0:45 ` [Qemu-devel] [PULL 12/17] dump: Drop qmp_dump_guest_memory() stub and build for all targets Andreas Färber
2013-06-13 0:45 ` [Qemu-devel] [PULL 13/17] cpu: Change default for CPUClass::get_paging_enabled() Andreas Färber
2013-06-13 0:45 ` [Qemu-devel] [PULL 14/17] dump: Abstract dump_init() with cpu_synchronize_all_states() Andreas Färber
2013-06-13 0:45 ` [Qemu-devel] [PULL 15/17] memory_mapping: Improve qemu_get_guest_memory_mapping() error reporting Andreas Färber
2013-06-13 0:45 ` [Qemu-devel] [PULL 16/17] spapr_rtas: Abstract rtas_query_cpu_stopped_state() with qemu_get_cpu() Andreas Färber
2013-06-13 0:45 ` [Qemu-devel] [PULL 17/17] spapr_rtas: Abstract rtas_start_cpu() " Andreas Färber
2013-06-17 21:17 ` [Qemu-devel] [PULL 00/17] QOM CPUState patch queue 2013-06-12 Anthony Liguori
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1371084329-814-7-git-send-email-afaerber@suse.de \
--to=afaerber@suse.de \
--cc=imammedo@redhat.com \
--cc=qemu-devel@nongnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).