From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:48835) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YQNQ3-0007Uj-Oj for qemu-devel@nongnu.org; Tue, 24 Feb 2015 16:53:35 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1YQNPv-0007OQ-OS for qemu-devel@nongnu.org; Tue, 24 Feb 2015 16:53:31 -0500 Received: from e8.ny.us.ibm.com ([32.97.182.138]:45158) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YQNPv-0007OA-Is for qemu-devel@nongnu.org; Tue, 24 Feb 2015 16:53:23 -0500 Received: from /spool/local by e8.ny.us.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Tue, 24 Feb 2015 16:53:23 -0500 From: Michael Roth Date: Tue, 24 Feb 2015 15:48:07 -0600 Message-Id: <1424814498-6993-33-git-send-email-mdroth@linux.vnet.ibm.com> In-Reply-To: <1424814498-6993-1-git-send-email-mdroth@linux.vnet.ibm.com> References: <1424814498-6993-1-git-send-email-mdroth@linux.vnet.ibm.com> Subject: [Qemu-devel] [PATCH 32/43] vt82c686: avoid out-of-bounds read List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Paolo Bonzini , Michael Tokarev , qemu-stable@nongnu.org From: Paolo Bonzini superio_ioport_readb can read the 256th element of the array. Coverity reports an out-of-bounds write in superio_ioport_writeb, but it does not show the corresponding out-of-bounds read because it cannot prove that it can happen. Fix the root cause of the problem (zhanghailang's patch instead fixes the logic in superio_ioport_writeb). Signed-off-by: Paolo Bonzini Reviewed-by: zhanghailiang Signed-off-by: Michael Tokarev Cc: qemu-stable@nongnu.org (cherry picked from commit 9feb8adeaa850d15b930c30f22c1ed2f2f695172) Signed-off-by: Michael Roth --- hw/isa/vt82c686.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/isa/vt82c686.c b/hw/isa/vt82c686.c index e0c235c..a43e26d 100644 --- a/hw/isa/vt82c686.c +++ b/hw/isa/vt82c686.c @@ -36,7 +36,7 @@ typedef struct SuperIOConfig { - uint8_t config[0xff]; + uint8_t config[0x100]; uint8_t index; uint8_t data; } SuperIOConfig; -- 1.9.1