* [PATCH for-5.2] util/cutils: Fix bounds check at freq_to_str()
@ 2020-10-29 20:38 Eduardo Habkost
2020-10-29 21:34 ` Philippe Mathieu-Daudé
2020-10-30 9:59 ` Peter Maydell
0 siblings, 2 replies; 3+ messages in thread
From: Eduardo Habkost @ 2020-10-29 20:38 UTC (permalink / raw)
To: qemu-devel
Cc: Peter Maydell, Alistair Francis, Luc Michel,
Philippe Mathieu-Daudé, Richard Henderson
Fix bounds check for idx at freq_to_str(), to actually ensure idx
never goes beyond the last element of the suffixes array.
Reported-by: Coverity (CID 1435957: OVERRUN)
Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
---
util/cutils.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/util/cutils.c b/util/cutils.c
index c395974fab..0d9261e1e5 100644
--- a/util/cutils.c
+++ b/util/cutils.c
@@ -891,7 +891,7 @@ char *freq_to_str(uint64_t freq_hz)
double freq = freq_hz;
size_t idx = 0;
- while (freq >= 1000.0 && idx < ARRAY_SIZE(suffixes)) {
+ while (freq >= 1000.0 && idx < ARRAY_SIZE(suffixes) - 1) {
freq /= 1000.0;
idx++;
}
--
2.28.0
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH for-5.2] util/cutils: Fix bounds check at freq_to_str()
2020-10-29 20:38 [PATCH for-5.2] util/cutils: Fix bounds check at freq_to_str() Eduardo Habkost
@ 2020-10-29 21:34 ` Philippe Mathieu-Daudé
2020-10-30 9:59 ` Peter Maydell
1 sibling, 0 replies; 3+ messages in thread
From: Philippe Mathieu-Daudé @ 2020-10-29 21:34 UTC (permalink / raw)
To: Eduardo Habkost, qemu-devel
Cc: Luc Michel, Peter Maydell, Alistair Francis, Richard Henderson
On 10/29/20 9:38 PM, Eduardo Habkost wrote:
> Fix bounds check for idx at freq_to_str(), to actually ensure idx
> never goes beyond the last element of the suffixes array.
>
> Reported-by: Coverity (CID 1435957: OVERRUN)
> Suggested-by: Peter Maydell <peter.maydell@linaro.org>
> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
> ---
> util/cutils.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/util/cutils.c b/util/cutils.c
> index c395974fab..0d9261e1e5 100644
> --- a/util/cutils.c
> +++ b/util/cutils.c
> @@ -891,7 +891,7 @@ char *freq_to_str(uint64_t freq_hz)
> double freq = freq_hz;
> size_t idx = 0;
>
> - while (freq >= 1000.0 && idx < ARRAY_SIZE(suffixes)) {
> + while (freq >= 1000.0 && idx < ARRAY_SIZE(suffixes) - 1) {
This was the first patch I wrote, but thought this wasn't the
simplest way. Probably too tired.
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Thanks.
> freq /= 1000.0;
> idx++;
> }
>
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH for-5.2] util/cutils: Fix bounds check at freq_to_str()
2020-10-29 20:38 [PATCH for-5.2] util/cutils: Fix bounds check at freq_to_str() Eduardo Habkost
2020-10-29 21:34 ` Philippe Mathieu-Daudé
@ 2020-10-30 9:59 ` Peter Maydell
1 sibling, 0 replies; 3+ messages in thread
From: Peter Maydell @ 2020-10-30 9:59 UTC (permalink / raw)
To: Eduardo Habkost
Cc: Alistair Francis, Philippe Mathieu-Daudé, Luc Michel,
QEMU Developers, Richard Henderson
On Thu, 29 Oct 2020 at 20:38, Eduardo Habkost <ehabkost@redhat.com> wrote:
>
> Fix bounds check for idx at freq_to_str(), to actually ensure idx
> never goes beyond the last element of the suffixes array.
>
> Reported-by: Coverity (CID 1435957: OVERRUN)
> Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Personally I preferred the other option (remove the
idx check from the while loop and assert that idx
is in bounds after the loop)...
> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
thanks
-- PMM
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2020-10-30 10:01 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2020-10-29 20:38 [PATCH for-5.2] util/cutils: Fix bounds check at freq_to_str() Eduardo Habkost
2020-10-29 21:34 ` Philippe Mathieu-Daudé
2020-10-30 9:59 ` Peter Maydell
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).