* [Qemu-devel] [PATCH] cadence_uart: Fix buffer overflow
@ 2012-09-01 9:12 Stefan Weil
2012-09-04 4:40 ` Peter Crosthwaite
2012-09-22 15:30 ` [Qemu-devel] [Qemu-trivial] " Stefan Hajnoczi
0 siblings, 2 replies; 3+ messages in thread
From: Stefan Weil @ 2012-09-01 9:12 UTC (permalink / raw)
To: Peter Crosthwaite; +Cc: qemu-trivial, Stefan Weil, qemu-devel
Report from smatch:
hw/cadence_uart.c:413 uart_read(13) error: buffer overflow 's->r' 18 <= 18
This fixes read access to s->r[R_MAX] which is behind the limits of s->r.
Signed-off-by: Stefan Weil <sw@weilnetz.de>
---
hw/cadence_uart.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/hw/cadence_uart.c b/hw/cadence_uart.c
index d98e531..f8afc4e 100644
--- a/hw/cadence_uart.c
+++ b/hw/cadence_uart.c
@@ -404,7 +404,7 @@ static uint64_t uart_read(void *opaque, target_phys_addr_t offset,
uint32_t c = 0;
offset >>= 2;
- if (offset > R_MAX) {
+ if (offset >= R_MAX) {
return 0;
} else if (offset == R_TX_RX) {
uart_read_rx_fifo(s, &c);
--
1.7.10
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [Qemu-devel] [PATCH] cadence_uart: Fix buffer overflow
2012-09-01 9:12 [Qemu-devel] [PATCH] cadence_uart: Fix buffer overflow Stefan Weil
@ 2012-09-04 4:40 ` Peter Crosthwaite
2012-09-22 15:30 ` [Qemu-devel] [Qemu-trivial] " Stefan Hajnoczi
1 sibling, 0 replies; 3+ messages in thread
From: Peter Crosthwaite @ 2012-09-04 4:40 UTC (permalink / raw)
To: Stefan Weil; +Cc: qemu-trivial, peter.crosthwaite, qemu-devel
Thanks Stefan,
Please enqueue to Trivial.
Regards,
Peter
On Sat, Sep 1, 2012 at 7:12 PM, Stefan Weil <sw@weilnetz.de> wrote:
> Report from smatch:
> hw/cadence_uart.c:413 uart_read(13) error: buffer overflow 's->r' 18 <= 18
>
> This fixes read access to s->r[R_MAX] which is behind the limits of s->r.
>
> Signed-off-by: Stefan Weil <sw@weilnetz.de>
Reviewed-by: Peter Crosthwaite <peter.crosthwaite@petalogix.com>
> ---
> hw/cadence_uart.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/hw/cadence_uart.c b/hw/cadence_uart.c
> index d98e531..f8afc4e 100644
> --- a/hw/cadence_uart.c
> +++ b/hw/cadence_uart.c
> @@ -404,7 +404,7 @@ static uint64_t uart_read(void *opaque, target_phys_addr_t offset,
> uint32_t c = 0;
>
> offset >>= 2;
> - if (offset > R_MAX) {
> + if (offset >= R_MAX) {
> return 0;
> } else if (offset == R_TX_RX) {
> uart_read_rx_fifo(s, &c);
> --
> 1.7.10
>
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [Qemu-devel] [Qemu-trivial] [PATCH] cadence_uart: Fix buffer overflow
2012-09-01 9:12 [Qemu-devel] [PATCH] cadence_uart: Fix buffer overflow Stefan Weil
2012-09-04 4:40 ` Peter Crosthwaite
@ 2012-09-22 15:30 ` Stefan Hajnoczi
1 sibling, 0 replies; 3+ messages in thread
From: Stefan Hajnoczi @ 2012-09-22 15:30 UTC (permalink / raw)
To: Stefan Weil; +Cc: Peter Crosthwaite, qemu-trivial, qemu-devel
On Sat, Sep 01, 2012 at 11:12:23AM +0200, Stefan Weil wrote:
> Report from smatch:
> hw/cadence_uart.c:413 uart_read(13) error: buffer overflow 's->r' 18 <= 18
>
> This fixes read access to s->r[R_MAX] which is behind the limits of s->r.
>
> Signed-off-by: Stefan Weil <sw@weilnetz.de>
> ---
> hw/cadence_uart.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
Thanks, applied to the trivial patches tree:
https://github.com/stefanha/qemu/commits/trivial-patches
Stefan
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2012-09-22 15:31 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-09-01 9:12 [Qemu-devel] [PATCH] cadence_uart: Fix buffer overflow Stefan Weil
2012-09-04 4:40 ` Peter Crosthwaite
2012-09-22 15:30 ` [Qemu-devel] [Qemu-trivial] " Stefan Hajnoczi
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).