Re: [Qemu-devel] index out of bounds in qemu-0.10.2

[Blue Swirl <blauwirbel@gmail.com>]

On 4/17/09, Sergei Steshenko <sergstesh@yahoo.com> wrote:
> Hello,
>
>  I am compiling qemu-0.10.2 using the attached autogenerated 'configure'
>  wrapper (if anybody is interested in 'configure' command line options I'm
>  using_.
>
>  I am using self-built gcc-4.3.3, my OS is SUSE 10.3, 32 bits.
>
>  While running 'make' I've noticed this:
>
>      41 /mnt/sdb8/sergei/AFSWD_debug/build/qemu-0.10.2/hw/twl92230.c: In function ‘menelaus_load’:
>      42 /mnt/sdb8/sergei/AFSWD_debug/build/qemu-0.10.2/hw/hw.h:114: warning: array subscript is above array bounds
>      43 /mnt/sdb8/sergei/AFSWD_debug/build/qemu-0.10.2/hw/hw.h:114: warning: array subscript is above array bounds
>      44 /mnt/sdb8/sergei/AFSWD_debug/build/qemu-0.10.2/hw/hw.h:114: warning: array subscript is above array bounds
>      45 /mnt/sdb8/sergei/AFSWD_debug/build/qemu-0.10.2/hw/twl92230.c: In function ‘menelaus_save’:
>      46 /mnt/sdb8/sergei/AFSWD_debug/build/qemu-0.10.2/hw/hw.h:94: warning: array subscript is above array bounds
>      47 /mnt/sdb8/sergei/AFSWD_debug/build/qemu-0.10.2/hw/hw.h:94: warning: array subscript is above array bounds
>      48 /mnt/sdb8/sergei/AFSWD_debug/build/qemu-0.10.2/hw/hw.h:94: warning: array subscript is above array bounds
>  .
>
>  Once I had the same warnings compiling my own code, and 'gcc' was correct,
>  so most likely it's correct in this case too.
>
>  If so, please fix this.

My gcc and even sparse is completely silent, strange.

It's because of this area:

    uint8_t dcdc[3];

is saved like this:

    qemu_put_8s(f, &s->dcdc[3]);
    qemu_put_8s(f, &s->dcdc[3]);
    qemu_put_8s(f, &s->dcdc[3]);

and loaded like this:

    qemu_get_8s(f, &s->dcdc[3]);
    qemu_get_8s(f, &s->dcdc[3]);
    qemu_get_8s(f, &s->dcdc[3]);

which is of course wrong.