* [Qemu-devel] [PATCH] target-cris/translate.c: fix out of bounds read
@ 2014-11-17 5:57 zhanghailiang
2014-11-17 10:59 ` Paolo Bonzini
0 siblings, 1 reply; 2+ messages in thread
From: zhanghailiang @ 2014-11-17 5:57 UTC (permalink / raw)
To: qemu-trivial
Cc: zhanghailiang, edgar.iglesias, peter.huangpeng, qemu-devel,
pbonzini
In function t_gen_mov_TN_preg and t_gen_mov_preg_TN, The begin check about the
validity of in-parameter 'r' is useless. We still access cpu_PR[r] in the
follow code if it is invalid. Which will be an out-of-bounds read error.
Fix it by using assert() to ensure it is valid before using it.
Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
---
target-cris/translate.c | 8 ++------
1 file changed, 2 insertions(+), 6 deletions(-)
diff --git a/target-cris/translate.c b/target-cris/translate.c
index e37b04e..76406af 100644
--- a/target-cris/translate.c
+++ b/target-cris/translate.c
@@ -169,9 +169,7 @@ static int preg_sizes[] = {
static inline void t_gen_mov_TN_preg(TCGv tn, int r)
{
- if (r < 0 || r > 15) {
- fprintf(stderr, "wrong register read $p%d\n", r);
- }
+ assert(r >= 0 && r <= 15);
if (r == PR_BZ || r == PR_WZ || r == PR_DZ) {
tcg_gen_mov_tl(tn, tcg_const_tl(0));
} else if (r == PR_VR) {
@@ -182,9 +180,7 @@ static inline void t_gen_mov_TN_preg(TCGv tn, int r)
}
static inline void t_gen_mov_preg_TN(DisasContext *dc, int r, TCGv tn)
{
- if (r < 0 || r > 15) {
- fprintf(stderr, "wrong register write $p%d\n", r);
- }
+ assert(r >= 0 && r <= 15);
if (r == PR_BZ || r == PR_WZ || r == PR_DZ) {
return;
} else if (r == PR_SRS) {
--
1.7.12.4
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [Qemu-devel] [PATCH] target-cris/translate.c: fix out of bounds read
2014-11-17 5:57 [Qemu-devel] [PATCH] target-cris/translate.c: fix out of bounds read zhanghailiang
@ 2014-11-17 10:59 ` Paolo Bonzini
0 siblings, 0 replies; 2+ messages in thread
From: Paolo Bonzini @ 2014-11-17 10:59 UTC (permalink / raw)
To: zhanghailiang, qemu-trivial; +Cc: edgar.iglesias, qemu-devel, peter.huangpeng
On 17/11/2014 06:57, zhanghailiang wrote:
> In function t_gen_mov_TN_preg and t_gen_mov_preg_TN, The begin check about the
> validity of in-parameter 'r' is useless. We still access cpu_PR[r] in the
> follow code if it is invalid. Which will be an out-of-bounds read error.
>
> Fix it by using assert() to ensure it is valid before using it.
>
> Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
> ---
> target-cris/translate.c | 8 ++------
> 1 file changed, 2 insertions(+), 6 deletions(-)
>
> diff --git a/target-cris/translate.c b/target-cris/translate.c
> index e37b04e..76406af 100644
> --- a/target-cris/translate.c
> +++ b/target-cris/translate.c
> @@ -169,9 +169,7 @@ static int preg_sizes[] = {
>
> static inline void t_gen_mov_TN_preg(TCGv tn, int r)
> {
> - if (r < 0 || r > 15) {
> - fprintf(stderr, "wrong register read $p%d\n", r);
> - }
> + assert(r >= 0 && r <= 15);
> if (r == PR_BZ || r == PR_WZ || r == PR_DZ) {
> tcg_gen_mov_tl(tn, tcg_const_tl(0));
> } else if (r == PR_VR) {
> @@ -182,9 +180,7 @@ static inline void t_gen_mov_TN_preg(TCGv tn, int r)
> }
> static inline void t_gen_mov_preg_TN(DisasContext *dc, int r, TCGv tn)
> {
> - if (r < 0 || r > 15) {
> - fprintf(stderr, "wrong register write $p%d\n", r);
> - }
> + assert(r >= 0 && r <= 15);
> if (r == PR_BZ || r == PR_WZ || r == PR_DZ) {
> return;
> } else if (r == PR_SRS) {
>
Applied, thanks.
Paolo
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2014-11-17 11:00 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-11-17 5:57 [Qemu-devel] [PATCH] target-cris/translate.c: fix out of bounds read zhanghailiang
2014-11-17 10:59 ` Paolo Bonzini
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).