Google Git
Sign in
qemu / qemu / a32354e206895400d17c3de9a8df1de96d3df289
commita32354e206895400d17c3de9a8df1de96d3df289[log] [tgz]
authorStefan Weil <sw@weilnetz.de>Tue Sep 04 19:37:39 2012 +0200
committerAurelien Jarno <aurelien@aurel32.net>Mon Sep 10 15:03:05 2012 +0200
treee86f905ffe9c8c200390c45a5e82f7739b4af6a5
parent599d64f6dc10f267a45e7abebfcafd8e7626585b [diff]
hw/mcf5206: Fix buffer overflow for MBAR read / write

Report from smatch:

mcf5206.c:384 m5206_mbar_readb(7) error: buffer overflow 'm5206_mbar_width' 128 <= 128
mcf5206.c:403 m5206_mbar_readw(8) error: buffer overflow 'm5206_mbar_width' 128 <= 128
mcf5206.c:427 m5206_mbar_readl(8) error: buffer overflow 'm5206_mbar_width' 128 <= 128
mcf5206.c:451 m5206_mbar_writeb(9) error: buffer overflow 'm5206_mbar_width' 128 <= 128
mcf5206.c:475 m5206_mbar_writew(9) error: buffer overflow 'm5206_mbar_width' 128 <= 128
mcf5206.c:503 m5206_mbar_writel(9) error: buffer overflow 'm5206_mbar_width' 128 <= 128

m5206_mbar_width has 0x80 elements and supports 0 <= offset < 0x200.

Signed-off-by: Stefan Weil <sw@weilnetz.de>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
1 file changed
tree: e86f905ffe9c8c200390c45a5e82f7739b4af6a5
  1. audio/
  2. block/
  3. bsd-user/
  4. default-configs/
  5. docs/
  6. fpu/
  7. fsdev/
  8. gdb-xml/
  9. hw/
  10. include/
  11. libcacard/
  12. linux-headers/
  13. linux-user/
  14. net/
  15. pc-bios/
  16. qapi/
  17. qga/
  18. QMP/
  19. qom/
  20. roms/
  21. scripts/
  22. slirp/
  23. sysconfigs/
  24. target-alpha/
  25. target-arm/
  26. target-cris/
  27. target-i386/
  28. target-lm32/
  29. target-m68k/
  30. target-microblaze/
  31. target-mips/
  32. target-openrisc/
  33. target-ppc/
  34. target-s390x/
  35. target-sh4/
  36. target-sparc/
  37. target-unicore32/
  38. target-xtensa/
  39. tcg/
  40. tests/
  41. trace/
  42. ui/
  43. .gitignore
  44. .gitmodules
  45. .mailmap
  46. a.out.h
  47. acl.c
  48. acl.h
  49. aes.c
  50. aes.h
  51. aio.c
  52. alpha-dis.c
  53. alpha.ld
  54. arch_init.c
  55. arch_init.h
  56. arm-dis.c
  57. arm.ld
  58. async.c
  59. balloon.c
  60. balloon.h
  61. bitmap.c
  62. bitmap.h
  63. bitops.c
  64. bitops.h
  65. block-migration.c
  66. block-migration.h
  67. block.c
  68. block.h
  69. block_int.h
  70. blockdev.c
  71. blockdev.h
  72. bswap.h
  73. bt-host.c
  74. bt-host.h
  75. bt-vhci.c
  76. buffered_file.c
  77. buffered_file.h
  78. cache-utils.c
  79. cache-utils.h
  80. Changelog
  81. cmd.c
  82. cmd.h
  83. CODING_STYLE
  84. compatfd.c
  85. compatfd.h
  86. compiler.h
  87. config.h
  88. configure
  89. console.c
  90. console.h
  91. COPYING
  92. COPYING.LIB
  93. coroutine-gthread.c
  94. coroutine-sigaltstack.c
  95. coroutine-ucontext.c
  96. coroutine-win32.c
  97. cpu-all.h
  98. cpu-common.h
  99. cpu-defs.h
  100. cpu-exec.c
  101. cpus.c
  102. cpus.h
  103. cputlb.c
  104. cputlb.h
  105. cris-dis.c
  106. cursor.c
  107. cursor_hidden.xpm
  108. cursor_left_ptr.xpm
  109. cutils.c
  110. def-helper.h
  111. device_tree.c
  112. device_tree.h
  113. dis-asm.h
  114. disas.c
  115. disas.h
  116. dma-helpers.c
  117. dma.h
  118. dump-stub.c
  119. dump.c
  120. dump.h
  121. dyngen-exec.h
  122. elf.h
  123. envlist.c
  124. envlist.h
  125. error.c
  126. error.h
  127. event_notifier.c
  128. event_notifier.h
  129. exec-all.h
  130. exec-memory.h
  131. exec-obsolete.h
  132. exec.c
  133. gdbstub.c
  134. gdbstub.h
  135. gen-icount.h
  136. HACKING
  137. hmp-commands.hx
  138. hmp.c
  139. hmp.h
  140. host-utils.c
  141. host-utils.h
  142. hppa-dis.c
  143. hppa.ld
  144. i386-dis.c
  145. i386.ld
  146. ia64-dis.c
  147. ia64.ld
  148. input.c
  149. int128.h
  150. iohandler.c
  151. ioport.c
  152. ioport.h
  153. iorange.h
  154. iov.c
  155. iov.h
  156. json-lexer.c
  157. json-lexer.h
  158. json-parser.c
  159. json-parser.h
  160. json-streamer.c
  161. json-streamer.h
  162. kvm-all.c
  163. kvm-stub.c
  164. kvm.h
  165. libfdt_env.h
  166. LICENSE
  167. linux-aio.c
  168. lm32-dis.c
  169. m68k-dis.c
  170. m68k.ld
  171. main-loop.c
  172. main-loop.h
  173. MAINTAINERS
  174. Makefile
  175. Makefile.dis
  176. Makefile.hw
  177. Makefile.objs
  178. Makefile.target
  179. Makefile.user
  180. memory.c
  181. memory.h
  182. memory_mapping-stub.c
  183. memory_mapping.c
  184. memory_mapping.h
  185. microblaze-dis.c
  186. migration-exec.c
  187. migration-fd.c
  188. migration-tcp.c
  189. migration-unix.c
  190. migration.c
  191. migration.h
  192. mips-dis.c
  193. mips.ld
  194. module.c
  195. module.h
  196. monitor.c
  197. monitor.h
  198. nbd.c
  199. nbd.h
  200. net.c
  201. net.h
  202. notify.c
  203. notify.h
  204. os-posix.c
  205. os-win32.c
  206. osdep.c
  207. osdep.h
  208. oslib-posix.c
  209. oslib-win32.c
  210. page_cache.c
  211. path.c
  212. pci-ids.txt
  213. pflib.c
  214. pflib.h
  215. poison.h
  216. posix-aio-compat.c
  217. ppc-dis.c
  218. ppc.ld
  219. ppc64.ld
  220. qapi-schema-guest.json
  221. qapi-schema-test.json
  222. qapi-schema.json
  223. qbool.c
  224. qbool.h
  225. qdict-test-data.txt
  226. qdict.c
  227. qdict.h
  228. qemu-aio.h
  229. qemu-barrier.h
  230. qemu-bridge-helper.c
  231. qemu-char.c
  232. qemu-char.h
  233. qemu-common.h
  234. qemu-config.c
  235. qemu-config.h
  236. qemu-coroutine-int.h
  237. qemu-coroutine-io.c
  238. qemu-coroutine-lock.c
  239. qemu-coroutine-sleep.c
  240. qemu-coroutine.c
  241. qemu-coroutine.h
  242. qemu-doc.texi
  243. qemu-error.c
  244. qemu-error.h
  245. qemu-file.h
  246. qemu-ga.c
  247. qemu-img-cmds.hx
  248. qemu-img.c
  249. qemu-img.texi
  250. qemu-io.c
  251. qemu-lock.h
  252. qemu-log.c
  253. qemu-log.h
  254. qemu-nbd.c
  255. qemu-nbd.texi
  256. qemu-objects.h
  257. qemu-option-internal.h
  258. qemu-option.c
  259. qemu-option.h
  260. qemu-options-wrapper.h
  261. qemu-options.h
  262. qemu-options.hx
  263. qemu-os-posix.h
  264. qemu-os-win32.h
  265. qemu-progress.c
  266. qemu-queue.h
  267. qemu-seccomp.c
  268. qemu-seccomp.h
  269. qemu-sockets.c
  270. qemu-tech.texi
  271. qemu-thread-posix.c
  272. qemu-thread-posix.h
  273. qemu-thread-win32.c
  274. qemu-thread-win32.h
  275. qemu-thread.h
  276. qemu-timer-common.c
  277. qemu-timer.c
  278. qemu-timer.h
  279. qemu-tls.h
  280. qemu-tool.c
  281. qemu-user.c
  282. qemu-x509.h
  283. qemu-xattr.h
  284. qemu.sasl
  285. qemu_socket.h
  286. qerror.c
  287. qerror.h
  288. qfloat.c
  289. qfloat.h
  290. qint.c
  291. qint.h
  292. qjson.c
  293. qjson.h
  294. qlist.c
  295. qlist.h
  296. qmp-commands.hx
  297. qmp.c
  298. qobject.h
  299. qstring.c
  300. qstring.h
  301. qtest.c
  302. qtest.h
  303. range.h
  304. readline.c
  305. readline.h
  306. README
  307. rules.mak
  308. s390-dis.c
  309. s390.ld
  310. savevm.c
  311. sh4-dis.c
  312. softmmu-semi.h
  313. softmmu_defs.h
  314. softmmu_exec.h
  315. softmmu_header.h
  316. softmmu_template.h
  317. sparc-dis.c
  318. sparc.ld
  319. sparc64.ld
  320. spice-qemu-char.c
  321. sysemu.h
  322. targphys.h
  323. tcg-runtime.c
  324. tci-dis.c
  325. tci.c
  326. thunk.c
  327. thunk.h
  328. TODO
  329. trace-events
  330. translate-all.c
  331. uboot_image.h
  332. user-exec.c
  333. VERSION
  334. version.rc
  335. vgafont.h
  336. vl.c
  337. vmstate.h
  338. x86_64.ld
  339. xen-all.c
  340. xen-mapcache.c
  341. xen-mapcache.h
  342. xen-stub.c