[Qemu-devel] [PATCH] pseries: Fix possible out-of-bounds error

[Qemu-devel] [PATCH] pseries: Fix possible out-of-bounds error

[Stefan Weil]

PCI_NUM_REGIONS is 7, ARRAY_SIZE(bars) is 6. Either bars must be
extended by a 7th array element, or the loop which reads bars[i]
must terminate before it tries to read bars[6].

For dev->io_regions[6].size == 0, the old code also works,
but it is not obvious whether this is always true.

This bug was detected by cppcheck.

Cc: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Stefan Weil <sw@weilnetz.de>
---
 hw/spapr_pci.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/hw/spapr_pci.c b/hw/spapr_pci.c
index 7162588..cefde38 100644
--- a/hw/spapr_pci.c
+++ b/hw/spapr_pci.c
@@ -454,7 +454,7 @@ int spapr_populate_pci_devices(sPAPRPHBState *phb,
         reg[0].size = 0;
 
         n = 0;
-        for (i = 0; i < PCI_NUM_REGIONS; ++i) {
+        for (i = 0; i < PCI_NUM_REGIONS && i < ARRAY_SIZE(bars); ++i) {
             if (0 == dev->io_regions[i].size) {
                 continue;
             }
-- 
1.7.2.5

Re: [Qemu-devel] [PATCH] pseries: Fix possible out-of-bounds error

[Stefan Weil]

Am 21.11.2011 20:25, schrieb Stefan Weil:
> PCI_NUM_REGIONS is 7, ARRAY_SIZE(bars) is 6. Either bars must be
> extended by a 7th array element, or the loop which reads bars[i]
> must terminate before it tries to read bars[6].
>
> For dev->io_regions[6].size == 0, the old code also works,
> but it is not obvious whether this is always true.
>
> This bug was detected by cppcheck.
>
> Cc: David Gibson<david@gibson.dropbear.id.au>
> Signed-off-by: Stefan Weil<sw@weilnetz.de>
> ---
>   hw/spapr_pci.c |    2 +-
>   1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/hw/spapr_pci.c b/hw/spapr_pci.c
> index 7162588..cefde38 100644
> --- a/hw/spapr_pci.c
> +++ b/hw/spapr_pci.c
> @@ -454,7 +454,7 @@ int spapr_populate_pci_devices(sPAPRPHBState *phb,
>           reg[0].size = 0;
>
>           n = 0;
> -        for (i = 0; i<  PCI_NUM_REGIONS; ++i) {
> +        for (i = 0; i<  PCI_NUM_REGIONS&&  i<  ARRAY_SIZE(bars); ++i) {
>               if (0 == dev->io_regions[i].size) {
>                   continue;
>               }
>    

Ping? Can this be fixed in QEMU 1.0?

Re: [Qemu-devel] [PATCH] pseries: Fix possible out-of-bounds error

[David Gibson]

On Mon, Nov 28, 2011 at 06:53:33PM +0100, Stefan Weil wrote:
> Am 21.11.2011 20:25, schrieb Stefan Weil:
> >PCI_NUM_REGIONS is 7, ARRAY_SIZE(bars) is 6. Either bars must be
> >extended by a 7th array element, or the loop which reads bars[i]
> >must terminate before it tries to read bars[6].
> >
> >For dev->io_regions[6].size == 0, the old code also works,
> >but it is not obvious whether this is always true.
> >
> >This bug was detected by cppcheck.
> >
> >Cc: David Gibson<david@gibson.dropbear.id.au>
> >Signed-off-by: Stefan Weil<sw@weilnetz.de>
> >---
> >  hw/spapr_pci.c |    2 +-
> >  1 files changed, 1 insertions(+), 1 deletions(-)
> >
> >diff --git a/hw/spapr_pci.c b/hw/spapr_pci.c
> >index 7162588..cefde38 100644
> >--- a/hw/spapr_pci.c
> >+++ b/hw/spapr_pci.c
> >@@ -454,7 +454,7 @@ int spapr_populate_pci_devices(sPAPRPHBState *phb,
> >          reg[0].size = 0;
> >
> >          n = 0;
> >-        for (i = 0; i<  PCI_NUM_REGIONS; ++i) {
> >+        for (i = 0; i<  PCI_NUM_REGIONS&&  i<  ARRAY_SIZE(bars); ++i) {
> >              if (0 == dev->io_regions[i].size) {
> >                  continue;
> >              }
> 
> Ping? Can this be fixed in QEMU 1.0?

Sorry, for some reason I missed the initial post of this patch.

Alexey who wrote most of the spapr_pci code actually found and fixed
this already, but we had a bit of a miscommunication so I hadn't
realised to send it upstream yet.  I'll send a fix shortly for 1.0.

-- 
David Gibson			| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au	| minimalist, thank you.  NOT _the_ _other_
				| _way_ _around_!
http://www.ozlabs.org/~dgibson