[Top][All Lists]
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH 05/14] lm4549: Fix buffer overflow
From: |
Stefan Hajnoczi |
Subject: |
[Qemu-devel] [PATCH 05/14] lm4549: Fix buffer overflow |
Date: |
Sun, 23 Sep 2012 11:00:11 +0100 |
From: Stefan Weil <address@hidden>
Report from smatch:
lm4549.c:234 lm4549_write_samples(14) error:
buffer overflow 's->buffer' 1024 <= 1024
There must be enough space to add two entries starting with index
s->buffer_level, therefore the old check was wrong.
[Peter Maydell <address@hidden> clarifies the nature of the
analyser warning:
I don't object to making the change to placate the analyser,
but I don't think this is actually a buffer overrun. We always
add and remove samples from the buffer two at a time, so it's
not possible to get here with s->buffer_level == BUFFER_SIZE-1
(which is the only case where the old and new conditions
give different answers).]
Signed-off-by: Stefan Weil <address@hidden>
Signed-off-by: Stefan Hajnoczi <address@hidden>
---
hw/lm4549.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/hw/lm4549.c b/hw/lm4549.c
index 80b3ec4..e0137d5 100644
--- a/hw/lm4549.c
+++ b/hw/lm4549.c
@@ -224,7 +224,7 @@ uint32_t lm4549_write_samples(lm4549_state *s, uint32_t
left, uint32_t right)
This model supports 16-bit playback.
*/
- if (s->buffer_level >= LM4549_BUFFER_SIZE) {
+ if (s->buffer_level > LM4549_BUFFER_SIZE - 2) {
DPRINTF("write_sample Buffer full\n");
return 0;
}
--
1.7.10.4
- [Qemu-devel] [PULL 00/14] Trivial patches for 15 to 23 September 2012, Stefan Hajnoczi, 2012/09/23
- [Qemu-devel] [PATCH 01/14] target-i386: Allow tsc-frequency to be larger then 2.147G, Stefan Hajnoczi, 2012/09/23
- [Qemu-devel] [PATCH 03/14] qemu-sockets: Fix potential memory leak, Stefan Hajnoczi, 2012/09/23
- [Qemu-devel] [PATCH 02/14] qemu-ga: Remove unreachable code after g_error, Stefan Hajnoczi, 2012/09/23
- [Qemu-devel] [PATCH 04/14] cadence_uart: Fix buffer overflow, Stefan Hajnoczi, 2012/09/23
- [Qemu-devel] [PATCH 05/14] lm4549: Fix buffer overflow,
Stefan Hajnoczi <=
- [Qemu-devel] [PATCH 07/14] pflash_cfi01: Fix warning caused by unreachable code, Stefan Hajnoczi, 2012/09/23
- [Qemu-devel] [PATCH 06/14] ioh3420: Remove unreachable code, Stefan Hajnoczi, 2012/09/23
- [Qemu-devel] [PATCH 08/14] dtrace backend: add function to reserved words, Stefan Hajnoczi, 2012/09/23
- [Qemu-devel] [PATCH 09/14] curses: don't initialize curses when qemu is daemonized, Stefan Hajnoczi, 2012/09/23
- [Qemu-devel] [PATCH 10/14] TextConsole: saturate escape parameter in TTY_STATE_CSI, Stefan Hajnoczi, 2012/09/23
- [Qemu-devel] [PATCH 11/14] qemu-timer: simplify qemu_run_timers, Stefan Hajnoczi, 2012/09/23
- [Qemu-devel] [PATCH 13/14] net/socket: Fix compiler warning (regression for MinGW), Stefan Hajnoczi, 2012/09/23
- [Qemu-devel] [PATCH 12/14] linux-user: Remove redundant null check and replace free by g_free, Stefan Hajnoczi, 2012/09/23
- [Qemu-devel] [PATCH 14/14] w32: Always use standard instead of native format strings, Stefan Hajnoczi, 2012/09/23
- Re: [Qemu-devel] [PULL 00/14] Trivial patches for 15 to 23 September 2012, Anthony Liguori, 2012/09/25