|
 |
5544c1 |
From 8057ac10e8cba3acb89c11c94f04967306e55a9f Mon Sep 17 00:00:00 2001
|
|
|
5544c1 |
From: Stefan Weil <sw@weilnetz.de>
|
|
|
5544c1 |
Date: Fri, 7 Sep 2012 22:36:08 +0200
|
|
|
5544c1 |
Subject: [PATCH] target-cris: Fix buffer overflow
|
|
|
5544c1 |
|
|
|
5544c1 |
Report from smatch:
|
|
|
5544c1 |
|
|
|
5544c1 |
target-cris/translate.c:3464 cpu_dump_state(32) error:
|
|
|
5544c1 |
buffer overflow 'env->sregs' 4 <= 255
|
|
|
5544c1 |
|
|
|
5544c1 |
sregs is declared 'uint32_t sregs[4][16]', so the first index must be
|
|
|
5544c1 |
less than 4 or ARRAY_SIZE(env->sregs).
|
|
|
5544c1 |
|
|
|
5544c1 |
Signed-off-by: Stefan Weil <sw@weilnetz.de>
|
|
|
5544c1 |
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
|
|
|
5544c1 |
---
|
|
|
5544c1 |
target-cris/translate.c | 2 +-
|
|
|
5544c1 |
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
5544c1 |
|
|
|
5544c1 |
diff --git a/target-cris/translate.c b/target-cris/translate.c
|
|
|
5544c1 |
index 1ad9ec7..ad31877 100644
|
|
|
5544c1 |
--- a/target-cris/translate.c
|
|
|
5544c1 |
+++ b/target-cris/translate.c
|
|
|
5544c1 |
@@ -3458,7 +3458,7 @@ void cpu_dump_state (CPUCRISState *env, FILE *f, fprintf_function cpu_fprintf,
|
|
|
5544c1 |
}
|
|
|
5544c1 |
srs = env->pregs[PR_SRS];
|
|
|
5544c1 |
cpu_fprintf(f, "\nsupport function regs bank %x:\n", srs);
|
|
|
5544c1 |
- if (srs < 256) {
|
|
|
5544c1 |
+ if (srs < ARRAY_SIZE(env->sregs)) {
|
|
|
5544c1 |
for (i = 0; i < 16; i++) {
|
|
|
5544c1 |
cpu_fprintf(f, "s%2.2d=%8.8x ",
|
|
|
5544c1 |
i, env->sregs[srs][i]);
|
|
|
5544c1 |
--
|
|
|
5544c1 |
1.7.12.1
|
|
|
5544c1 |
|