david.venhoff/QEMU-Nyx-fork
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ppc405_uc: Fix buffer overflow

Browse Source 
Report from smatch:

ppc405_uc.c:209 dcr_read_pob(12) error: buffer overflow 'pob->besr' 2 <= 2
ppc405_uc.c:232 dcr_write_pob(12) error: buffer overflow 'pob->besr' 2 <= 2

The old code reads and writes besr[POB0_BESR1 - POB0_BESR0] or besr[2]
which is one too much.

Signed-off-by: Stefan Weil <sw@weilnetz.de>
Reviewed-by: Andreas Färber <afaerber@suse.de>
Signed-off-by: Alexander Graf <agraf@suse.de>
This commit is contained in:
Stefan Weil 2012-08-31 22:21:21 +02:00 committed by Alexander Graf
parent ace9a2cbac
commit 5a1972c847
1 changed files with 11 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
hw/ppc405_uc.c
View File

@ -191,7 +191,8 @@ enum {
typedef struct ppc4xx_pob_t ppc4xx_pob_t; typedef struct ppc4xx_pob_t ppc4xx_pob_t;
struct ppc4xx_pob_t { struct ppc4xx_pob_t {
uint32_t bear; uint32_t bear;
uint32_t besr[2]; uint32_t besr0;
uint32_t besr1;
}; };
static uint32_t dcr_read_pob (void *opaque, int dcrn) static uint32_t dcr_read_pob (void *opaque, int dcrn)
@ -205,8 +206,10 @@ static uint32_t dcr_read_pob (void *opaque, int dcrn)
ret = pob->bear; ret = pob->bear;
break; break;
case POB0_BESR0: case POB0_BESR0:
ret = pob->besr0;
break;
case POB0_BESR1: case POB0_BESR1:
ret = pob->besr[dcrn - POB0_BESR0]; ret = pob->besr1;
break; break;
default: default:
/* Avoid gcc warning */ /* Avoid gcc warning */
@ -227,9 +230,12 @@ static void dcr_write_pob (void *opaque, int dcrn, uint32_t val)
/* Read only */ /* Read only */
break; break;
case POB0_BESR0: case POB0_BESR0:
/* Write-clear */
pob->besr0 &= ~val;
break;
case POB0_BESR1: case POB0_BESR1:
/* Write-clear */ /* Write-clear */
pob->besr[dcrn - POB0_BESR0] &= ~val; pob->besr1 &= ~val;
break; break;
} }
} }
@ -241,8 +247,8 @@ static void ppc4xx_pob_reset (void *opaque)
pob = opaque; pob = opaque;
/* No error */ /* No error */
pob->bear = 0x00000000; pob->bear = 0x00000000;
pob->besr[0] = 0x0000000; pob->besr0 = 0x0000000;
pob->besr[1] = 0x0000000; pob->besr1 = 0x0000000;
} }
static void ppc4xx_pob_init(CPUPPCState *env) static void ppc4xx_pob_init(CPUPPCState *env)