From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:52301) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ai3eO-0002rp-KQ for qemu-devel@nongnu.org; Mon, 21 Mar 2016 13:29:59 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ai3eK-0001JR-Gb for qemu-devel@nongnu.org; Mon, 21 Mar 2016 13:29:56 -0400 Received: from e19.ny.us.ibm.com ([129.33.205.209]:37963) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ai3eK-0001J0-4B for qemu-devel@nongnu.org; Mon, 21 Mar 2016 13:29:52 -0400 Received: from localhost by e19.ny.us.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Mon, 21 Mar 2016 13:29:51 -0400 From: Michael Roth Date: Mon, 21 Mar 2016 12:28:20 -0500 Message-Id: <1458581313-19045-23-git-send-email-mdroth@linux.vnet.ibm.com> In-Reply-To: <1458581313-19045-1-git-send-email-mdroth@linux.vnet.ibm.com> References: <1458581313-19045-1-git-send-email-mdroth@linux.vnet.ibm.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Subject: [Qemu-devel] [PATCH 22/35] fw_cfg: avoid calculating invalid current entry pointer List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Michael Roth , "Gabriel L. Somlo" , qemu-stable@nongnu.org, =?UTF-8?q?Marc=20Mar=C3=AD?= , Gerd Hoffmann From: "Gabriel L. Somlo" When calculating a pointer to the currently selected fw_cfg item, the following is used: FWCfgEntry *e = &s->entries[arch][s->cur_entry & FW_CFG_ENTRY_MASK]; When s->cur_entry is FW_CFG_INVALID, we are calculating the address of a non-existent element in s->entries[arch][...], which is undefined. This patch ensures the resulting entry pointer is set to NULL whenever s->cur_entry is FW_CFG_INVALID. Reported-by: Laszlo Ersek Reviewed-by: Laszlo Ersek Signed-off-by: Gabriel Somlo Message-id: 1446733972-1602-5-git-send-email-somlo@cmu.edu Cc: Marc Marí Signed-off-by: Gabriel Somlo Reviewed-by: Laszlo Ersek Signed-off-by: Gerd Hoffmann (cherry picked from commit 66f8fd9dda312191b78d2a2ba2848bcee76127a2) Signed-off-by: Michael Roth --- hw/nvram/fw_cfg.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/hw/nvram/fw_cfg.c b/hw/nvram/fw_cfg.c index 73b0a81..117809b 100644 --- a/hw/nvram/fw_cfg.c +++ b/hw/nvram/fw_cfg.c @@ -270,7 +270,8 @@ static int fw_cfg_select(FWCfgState *s, uint16_t key) static uint8_t fw_cfg_read(FWCfgState *s) { int arch = !!(s->cur_entry & FW_CFG_ARCH_LOCAL); - FWCfgEntry *e = &s->entries[arch][s->cur_entry & FW_CFG_ENTRY_MASK]; + FWCfgEntry *e = (s->cur_entry == FW_CFG_INVALID) ? NULL : + &s->entries[arch][s->cur_entry & FW_CFG_ENTRY_MASK]; uint8_t ret; if (s->cur_entry == FW_CFG_INVALID || !e->data || s->cur_offset >= e->len) @@ -338,7 +339,8 @@ static void fw_cfg_dma_transfer(FWCfgState *s) } arch = !!(s->cur_entry & FW_CFG_ARCH_LOCAL); - e = &s->entries[arch][s->cur_entry & FW_CFG_ENTRY_MASK]; + e = (s->cur_entry == FW_CFG_INVALID) ? NULL : + &s->entries[arch][s->cur_entry & FW_CFG_ENTRY_MASK]; if (dma.control & FW_CFG_DMA_CTL_READ) { read = 1; -- 1.9.1