From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:34351) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WIiot-00016d-Cp for qemu-devel@nongnu.org; Wed, 26 Feb 2014 13:03:00 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1WIios-0007Sw-8w for qemu-devel@nongnu.org; Wed, 26 Feb 2014 13:02:59 -0500 Received: from mnementh.archaic.org.uk ([2001:8b0:1d0::1]:46191) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WIios-0007Eu-3D for qemu-devel@nongnu.org; Wed, 26 Feb 2014 13:02:58 -0500 From: Peter Maydell Date: Wed, 26 Feb 2014 18:01:53 +0000 Message-Id: <1393437755-23586-4-git-send-email-peter.maydell@linaro.org> In-Reply-To: <1393437755-23586-1-git-send-email-peter.maydell@linaro.org> References: <1393437755-23586-1-git-send-email-peter.maydell@linaro.org> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Subject: [Qemu-devel] [PULL 03/45] hw/timer/arm_timer: Avoid array overrun for bad addresses List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Anthony Liguori Cc: Blue Swirl , qemu-devel@nongnu.org, Aurelien Jarno The integrator's timer read/write functions log an error for bad addresses in guest accesses, but were falling through and using an out of bounds array index rather than returning early. Fix this. Signed-off-by: Peter Maydell Reviewed-by: Paolo Bonzini Reviewed-by: Andreas Färber Message-id: 1392647854-8067-4-git-send-email-peter.maydell@linaro.org Cc: qemu-stable@nongnu.org --- hw/timer/arm_timer.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/hw/timer/arm_timer.c b/hw/timer/arm_timer.c index a47afde..fb0a45c 100644 --- a/hw/timer/arm_timer.c +++ b/hw/timer/arm_timer.c @@ -320,6 +320,7 @@ static uint64_t icp_pit_read(void *opaque, hwaddr offset, n = offset >> 8; if (n > 2) { qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad timer %d\n", __func__, n); + return 0; } return arm_timer_read(s->timer[n], offset & 0xff); @@ -334,6 +335,7 @@ static void icp_pit_write(void *opaque, hwaddr offset, n = offset >> 8; if (n > 2) { qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad timer %d\n", __func__, n); + return; } arm_timer_write(s->timer[n], offset & 0xff, value); -- 1.9.0