[Qemu-devel] array overflow in hw/stellaris.c and hw/omap_dss.c

[Qemu-devel] array overflow in hw/stellaris.c and hw/omap_dss.c

[Jindrich Makovicka]

Hi,

there are some under-dimensioned arrays in $subj.

Index: stellaris.c
===================================================================
--- stellaris.c (revision 4846)
+++ stellaris.c (working copy)
@@ -1308,8 +1308,8 @@
     static const int gpio_irq[7] = {0, 1, 2, 3, 4, 30, 31};
 
     qemu_irq *pic;
-    qemu_irq *gpio_in[5];
-    qemu_irq *gpio_out[5];
+    qemu_irq *gpio_in[7];
+    qemu_irq *gpio_out[7];
     qemu_irq adc;
     int sram_size;
     int flash_size;
Index: omap_dss.c
===================================================================
--- omap_dss.c  (revision 4846)
+++ omap_dss.c  (working copy)
@@ -53,7 +53,7 @@
         uint32_t control;
         uint32_t config;
         uint32_t capable;
-        uint32_t timing[3];
+        uint32_t timing[4];
         int line;
         uint32_t bg[2];
         uint32_t trans[2];
@@ -148,6 +148,7 @@
     s->dispc.timing[0] = 0;
     s->dispc.timing[1] = 0;
     s->dispc.timing[2] = 0;
+    s->dispc.timing[3] = 0;
     s->dispc.line = 0;
     s->dispc.bg[0] = 0;
     s->dispc.bg[1] = 0;

Regards,
-- 
Jindrich Makovicka

Re: [Qemu-devel] array overflow in hw/stellaris.c and hw/omap_dss.c

[Aurelien Jarno]

On Sat, Jul 05, 2008 at 10:48:22AM +0200, Jindrich Makovicka wrote:
> Hi,
> 
> there are some under-dimensioned arrays in $subj.
> 

Applied, thanks.

> Index: stellaris.c
> ===================================================================
> --- stellaris.c (revision 4846)
> +++ stellaris.c (working copy)
> @@ -1308,8 +1308,8 @@
>      static const int gpio_irq[7] = {0, 1, 2, 3, 4, 30, 31};
>  
>      qemu_irq *pic;
> -    qemu_irq *gpio_in[5];
> -    qemu_irq *gpio_out[5];
> +    qemu_irq *gpio_in[7];
> +    qemu_irq *gpio_out[7];
>      qemu_irq adc;
>      int sram_size;
>      int flash_size;
> Index: omap_dss.c
> ===================================================================
> --- omap_dss.c  (revision 4846)
> +++ omap_dss.c  (working copy)
> @@ -53,7 +53,7 @@
>          uint32_t control;
>          uint32_t config;
>          uint32_t capable;
> -        uint32_t timing[3];
> +        uint32_t timing[4];
>          int line;
>          uint32_t bg[2];
>          uint32_t trans[2];
> @@ -148,6 +148,7 @@
>      s->dispc.timing[0] = 0;
>      s->dispc.timing[1] = 0;
>      s->dispc.timing[2] = 0;
> +    s->dispc.timing[3] = 0;
>      s->dispc.line = 0;
>      s->dispc.bg[0] = 0;
>      s->dispc.bg[1] = 0;
> 
> Regards,
> -- 
> Jindrich Makovicka
> 
> 
> 

-- 
  .''`.  Aurelien Jarno	            | GPG: 1024D/F1BCDB73
 : :' :  Debian developer           | Electrical Engineer
 `. `'   aurel32@debian.org         | aurelien@aurel32.net
   `-    people.debian.org/~aurel32 | www.aurel32.net