From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:40903) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TB3sV-0004cf-C2 for qemu-devel@nongnu.org; Mon, 10 Sep 2012 09:18:25 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1TB3sP-0000b9-62 for qemu-devel@nongnu.org; Mon, 10 Sep 2012 09:18:15 -0400 Received: from hall.aurel32.net ([88.191.126.93]:33473) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TB3sP-0000ax-0J for qemu-devel@nongnu.org; Mon, 10 Sep 2012 09:18:09 -0400 Date: Mon, 10 Sep 2012 15:18:06 +0200 From: Aurelien Jarno Message-ID: <20120910131806.GV6791@ohm.aurel32.net> References: <1346780259-9781-1-git-send-email-sw@weilnetz.de> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-15 Content-Disposition: inline In-Reply-To: <1346780259-9781-1-git-send-email-sw@weilnetz.de> Subject: Re: [Qemu-devel] [PATCH] hw/mcf5206: Fix buffer overflow for MBAR read / write List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Stefan Weil Cc: Paul Brook , qemu-devel@nongnu.org On Tue, Sep 04, 2012 at 07:37:39PM +0200, Stefan Weil wrote: > Report from smatch: > > mcf5206.c:384 m5206_mbar_readb(7) error: buffer overflow 'm5206_mbar_width' 128 <= 128 > mcf5206.c:403 m5206_mbar_readw(8) error: buffer overflow 'm5206_mbar_width' 128 <= 128 > mcf5206.c:427 m5206_mbar_readl(8) error: buffer overflow 'm5206_mbar_width' 128 <= 128 > mcf5206.c:451 m5206_mbar_writeb(9) error: buffer overflow 'm5206_mbar_width' 128 <= 128 > mcf5206.c:475 m5206_mbar_writew(9) error: buffer overflow 'm5206_mbar_width' 128 <= 128 > mcf5206.c:503 m5206_mbar_writel(9) error: buffer overflow 'm5206_mbar_width' 128 <= 128 > > m5206_mbar_width has 0x80 elements and supports 0 <= offset < 0x200. > > Signed-off-by: Stefan Weil > --- > hw/mcf5206.c | 12 ++++++------ > 1 file changed, 6 insertions(+), 6 deletions(-) > > diff --git a/hw/mcf5206.c b/hw/mcf5206.c > index 539b391..27753e2 100644 > --- a/hw/mcf5206.c > +++ b/hw/mcf5206.c > @@ -378,7 +378,7 @@ static uint32_t m5206_mbar_readb(void *opaque, target_phys_addr_t offset) > { > m5206_mbar_state *s = (m5206_mbar_state *)opaque; > offset &= 0x3ff; > - if (offset > 0x200) { > + if (offset >= 0x200) { > hw_error("Bad MBAR read offset 0x%x", (int)offset); > } > if (m5206_mbar_width[offset >> 2] > 1) { > @@ -397,7 +397,7 @@ static uint32_t m5206_mbar_readw(void *opaque, target_phys_addr_t offset) > m5206_mbar_state *s = (m5206_mbar_state *)opaque; > int width; > offset &= 0x3ff; > - if (offset > 0x200) { > + if (offset >= 0x200) { > hw_error("Bad MBAR read offset 0x%x", (int)offset); > } > width = m5206_mbar_width[offset >> 2]; > @@ -421,7 +421,7 @@ static uint32_t m5206_mbar_readl(void *opaque, target_phys_addr_t offset) > m5206_mbar_state *s = (m5206_mbar_state *)opaque; > int width; > offset &= 0x3ff; > - if (offset > 0x200) { > + if (offset >= 0x200) { > hw_error("Bad MBAR read offset 0x%x", (int)offset); > } > width = m5206_mbar_width[offset >> 2]; > @@ -445,7 +445,7 @@ static void m5206_mbar_writeb(void *opaque, target_phys_addr_t offset, > m5206_mbar_state *s = (m5206_mbar_state *)opaque; > int width; > offset &= 0x3ff; > - if (offset > 0x200) { > + if (offset >= 0x200) { > hw_error("Bad MBAR write offset 0x%x", (int)offset); > } > width = m5206_mbar_width[offset >> 2]; > @@ -469,7 +469,7 @@ static void m5206_mbar_writew(void *opaque, target_phys_addr_t offset, > m5206_mbar_state *s = (m5206_mbar_state *)opaque; > int width; > offset &= 0x3ff; > - if (offset > 0x200) { > + if (offset >= 0x200) { > hw_error("Bad MBAR write offset 0x%x", (int)offset); > } > width = m5206_mbar_width[offset >> 2]; > @@ -497,7 +497,7 @@ static void m5206_mbar_writel(void *opaque, target_phys_addr_t offset, > m5206_mbar_state *s = (m5206_mbar_state *)opaque; > int width; > offset &= 0x3ff; > - if (offset > 0x200) { > + if (offset >= 0x200) { > hw_error("Bad MBAR write offset 0x%x", (int)offset); > } > width = m5206_mbar_width[offset >> 2]; > -- > 1.7.10 > Thanks, applied. -- Aurelien Jarno GPG: 1024D/F1BCDB73 aurelien@aurel32.net http://www.aurel32.net