vitalif
/
mirror_qemu
mirror of https://github.com/proxmox/mirror_qemu
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

exynos: Fix out-of-bounds access in exynos4210_gcomp_find debug printf 

One of the debug printfs in exynos4210_gcomp_find() will
access outside the 's->g_timer.reg.comp[]' array if there
was no active comparator and 'res' is -1. Add a conditional
to avoid this.

This doesn't happen in normal use because the debug printfs
are by default not compiled in.

Signed-off-by: Feng Jiang <jiangfeng@kylinos.cn>
Message-id: 20230404074506.112615-1-jiangfeng@kylinos.cn
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: Adjusted commit message to clarify that the overrun
only happens if you've enabled debug printfs]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
master
Feng Jiang 2023-04-20 10:21:13 +01:00 committed by Peter Maydell
parent b3db996ffc
commit c47a80cd14
1 changed files with 8 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
hw/timer/exynos4210_mct.c
View File

@ -480,11 +480,14 @@ static int32_t exynos4210_gcomp_find(Exynos4210MCTState *s)
res = min_comp_i;
}
DPRINTF("found comparator %d: comp 0x%llx distance 0x%llx, gfrc 0x%llx\n",
res,
s->g_timer.reg.comp[res],
distance_min,
gfrc);
if (res >= 0) {
DPRINTF("found comparator %d: "
"comp 0x%llx distance 0x%llx, gfrc 0x%llx\n",
res,
s->g_timer.reg.comp[res],
distance_min,
gfrc);
}
return res;
}