From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:40555) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TACis-0008Ry-Pr for qemu-devel@nongnu.org; Sat, 08 Sep 2012 00:32:47 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1TACir-0007Bt-Lz for qemu-devel@nongnu.org; Sat, 08 Sep 2012 00:32:46 -0400 Received: from mail-lpp01m010-f45.google.com ([209.85.215.45]:41471) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TACir-0007BW-EA for qemu-devel@nongnu.org; Sat, 08 Sep 2012 00:32:45 -0400 Received: by lagz14 with SMTP id z14so127167lag.4 for ; Fri, 07 Sep 2012 21:32:44 -0700 (PDT) Date: Sat, 8 Sep 2012 06:32:35 +0200 From: "Edgar E. Iglesias" Message-ID: <20120908043235.GA3491@zapo> References: <1347050168-24347-1-git-send-email-sw@weilnetz.de> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1347050168-24347-1-git-send-email-sw@weilnetz.de> Subject: Re: [Qemu-devel] [PATCH v2] target-cris: Fix buffer overflow List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Stefan Weil Cc: qemu-devel@nongnu.org On Fri, Sep 07, 2012 at 10:36:08PM +0200, Stefan Weil wrote: > Report from smatch: > > target-cris/translate.c:3464 cpu_dump_state(32) error: > buffer overflow 'env->sregs' 4 <= 255 > > sregs is declared 'uint32_t sregs[4][16]', so the first index must be > less than 4 or ARRAY_SIZE(env->sregs). Thanks Stefan, applied > > Signed-off-by: Stefan Weil > --- > > I did not fix tabs, therefore checkpatch.pl reports an error. > > Changes in V2: > > * Use ARRAY_SIZE (suggested by Edgar). > > target-cris/translate.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/target-cris/translate.c b/target-cris/translate.c > index 1ad9ec7..34c0452 100644 > --- a/target-cris/translate.c > +++ b/target-cris/translate.c > @@ -3458,7 +3458,7 @@ void cpu_dump_state (CPUCRISState *env, FILE *f, fprintf_function cpu_fprintf, > } > srs = env->pregs[PR_SRS]; > cpu_fprintf(f, "\nsupport function regs bank %x:\n", srs); > - if (srs < 256) { > + if (srs < ARRAY_SIZE(env->sregs)) { > for (i = 0; i < 16; i++) { > cpu_fprintf(f, "s%2.2d=%8.8x ", > i, env->sregs[srs][i]); > -- > 1.7.10 >