From patchwork Sun Sep 23 10:00:10 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stefan Hajnoczi X-Patchwork-Id: 186203 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (Client did not present a certificate) by ozlabs.org (Postfix) with ESMTPS id E135F2C0093 for ; Sun, 23 Sep 2012 20:54:53 +1000 (EST) Received: from localhost ([::1]:46612 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TFizw-0005Z1-J1 for incoming@patchwork.ozlabs.org; Sun, 23 Sep 2012 06:01:12 -0400 Received: from eggs.gnu.org ([208.118.235.92]:59828) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TFizM-0003qL-6L for qemu-devel@nongnu.org; Sun, 23 Sep 2012 06:00:36 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1TFizL-0007ci-6g for qemu-devel@nongnu.org; Sun, 23 Sep 2012 06:00:36 -0400 Received: from mail-wi0-f175.google.com ([209.85.212.175]:51494) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TFizL-0007cW-01 for qemu-devel@nongnu.org; Sun, 23 Sep 2012 06:00:35 -0400 Received: by wiwc10 with SMTP id c10so120249wiw.10 for ; Sun, 23 Sep 2012 03:00:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:cc:subject:date:message-id:x-mailer:in-reply-to:references; bh=MB5FxjqI1TsbWSJ433kw27JZkA4/0VgdekokhvtXLJc=; b=pZn6eVkbZLq06Qrs4S4ZyIDebA7gixQZgEF8dDcGkVGf7Efr/ceFBe5TiyU0c354yE S8HivBNBaVmCTNFwcx1iZkbY3MgudsB5PO9Dn4O3MCZTgbdnpDHuXSFzrIfgOsyRKhAK snxqVH6P0ZkG0H0MJ49P9BUlHAcNubdmssHZHYVaE+vM0r9KiIXUPlwGVSiDRW3ItDtM GEnd1Ak6iBWWbUEGOG3rCPHmAoL1OQ7sB1tjsHULfgPAFcF5sqF26JcgSrwb6GiAfbHN i3przsYCgQ5t0bt8qeKK/9xVIhbsE4ZxZjpTenxWAwjZV1vmtzlLf2TU/V1I+A8Q0pkD O9AQ== Received: by 10.216.228.201 with SMTP id f51mr5347000weq.26.1348394434154; Sun, 23 Sep 2012 03:00:34 -0700 (PDT) Received: from localhost ([109.224.133.37]) by mx.google.com with ESMTPS id cw4sm4132988wib.4.2012.09.23.03.00.33 (version=TLSv1/SSLv3 cipher=OTHER); Sun, 23 Sep 2012 03:00:33 -0700 (PDT) From: Stefan Hajnoczi To: Anthony Liguori Date: Sun, 23 Sep 2012 11:00:10 +0100 Message-Id: <1348394420-28298-5-git-send-email-stefanha@gmail.com> X-Mailer: git-send-email 1.7.10.4 In-Reply-To: <1348394420-28298-1-git-send-email-stefanha@gmail.com> References: <1348394420-28298-1-git-send-email-stefanha@gmail.com> X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 209.85.212.175 Cc: Stefan Weil , qemu-devel@nongnu.org, Stefan Hajnoczi Subject: [Qemu-devel] [PATCH 04/14] cadence_uart: Fix buffer overflow X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org From: Stefan Weil Report from smatch: hw/cadence_uart.c:413 uart_read(13) error: buffer overflow 's->r' 18 <= 18 This fixes read access to s->r[R_MAX] which is behind the limits of s->r. Signed-off-by: Stefan Weil Signed-off-by: Stefan Hajnoczi --- hw/cadence_uart.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/cadence_uart.c b/hw/cadence_uart.c index d98e531..f8afc4e 100644 --- a/hw/cadence_uart.c +++ b/hw/cadence_uart.c @@ -404,7 +404,7 @@ static uint64_t uart_read(void *opaque, target_phys_addr_t offset, uint32_t c = 0; offset >>= 2; - if (offset > R_MAX) { + if (offset >= R_MAX) { return 0; } else if (offset == R_TX_RX) { uart_read_rx_fifo(s, &c);