From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:58112) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZuLb6-000430-S0 for qemu-devel@nongnu.org; Thu, 05 Nov 2015 09:33:09 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ZuLax-0001h7-9i for qemu-devel@nongnu.org; Thu, 05 Nov 2015 09:33:04 -0500 Received: from relay-05.andrew.cmu.edu ([128.2.157.12]:52827 helo=relay.andrew.cmu.edu) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZuLax-0001gV-4M for qemu-devel@nongnu.org; Thu, 05 Nov 2015 09:32:55 -0500 From: "Gabriel L. Somlo" Date: Thu, 5 Nov 2015 09:32:50 -0500 Message-Id: <1446733972-1602-5-git-send-email-somlo@cmu.edu> In-Reply-To: <1446733972-1602-1-git-send-email-somlo@cmu.edu> References: <1446733972-1602-1-git-send-email-somlo@cmu.edu> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Subject: [Qemu-devel] [PATCH v5 4/6] fw_cfg: avoid calculating invalid current entry pointer List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: peter.maydell@linaro.org, jordan.l.justen@intel.com, armbru@redhat.com, kraxel@redhat.com, pbonzini@redhat.com, markmb@redhat.com, lersek@redhat.com When calculating a pointer to the currently selected fw_cfg item, the following is used: FWCfgEntry *e =3D &s->entries[arch][s->cur_entry & FW_CFG_ENTRY_MASK]; When s->cur_entry is FW_CFG_INVALID, we are calculating the address of a non-existent element in s->entries[arch][...], which is undefined. This patch ensures the resulting entry pointer is set to NULL whenever s->cur_entry is FW_CFG_INVALID. Reported-by: Laszlo Ersek Cc: Marc Mar=C3=AD Signed-off-by: Gabriel Somlo Reviewed-by: Laszlo Ersek --- hw/nvram/fw_cfg.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/hw/nvram/fw_cfg.c b/hw/nvram/fw_cfg.c index c2d3a0a..046fa74 100644 --- a/hw/nvram/fw_cfg.c +++ b/hw/nvram/fw_cfg.c @@ -277,7 +277,8 @@ static int fw_cfg_select(FWCfgState *s, uint16_t key) static uint8_t fw_cfg_read(FWCfgState *s) { int arch =3D !!(s->cur_entry & FW_CFG_ARCH_LOCAL); - FWCfgEntry *e =3D &s->entries[arch][s->cur_entry & FW_CFG_ENTRY_MASK= ]; + FWCfgEntry *e =3D (s->cur_entry =3D=3D FW_CFG_INVALID) ? NULL : + &s->entries[arch][s->cur_entry & FW_CFG_ENTRY_MASK]; uint8_t ret; =20 if (s->cur_entry =3D=3D FW_CFG_INVALID || !e->data || s->cur_offset = >=3D e->len) @@ -342,7 +343,8 @@ static void fw_cfg_dma_transfer(FWCfgState *s) } =20 arch =3D !!(s->cur_entry & FW_CFG_ARCH_LOCAL); - e =3D &s->entries[arch][s->cur_entry & FW_CFG_ENTRY_MASK]; + e =3D (s->cur_entry =3D=3D FW_CFG_INVALID) ? NULL : + &s->entries[arch][s->cur_entry & FW_CFG_ENTRY_MASK]; =20 if (dma.control & FW_CFG_DMA_CTL_READ) { read =3D 1; --=20 2.4.3