[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 4/6] fw_cfg: avoid calculating invalid current entry
From: |
Gerd Hoffmann |
Subject: |
[Qemu-devel] [PULL 4/6] fw_cfg: avoid calculating invalid current entry pointer |
Date: |
Thu, 17 Dec 2015 10:01:48 +0100 |
From: "Gabriel L. Somlo" <address@hidden>
When calculating a pointer to the currently selected fw_cfg item, the
following is used:
FWCfgEntry *e = &s->entries[arch][s->cur_entry & FW_CFG_ENTRY_MASK];
When s->cur_entry is FW_CFG_INVALID, we are calculating the address of
a non-existent element in s->entries[arch][...], which is undefined.
This patch ensures the resulting entry pointer is set to NULL whenever
s->cur_entry is FW_CFG_INVALID.
Reported-by: Laszlo Ersek <address@hidden>
Reviewed-by: Laszlo Ersek <address@hidden>
Signed-off-by: Gabriel Somlo <address@hidden>
Message-id: address@hidden
Cc: Marc MarĂ <address@hidden>
Signed-off-by: Gabriel Somlo <address@hidden>
Reviewed-by: Laszlo Ersek <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>
---
hw/nvram/fw_cfg.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/hw/nvram/fw_cfg.c b/hw/nvram/fw_cfg.c
index c2d3a0a..046fa74 100644
--- a/hw/nvram/fw_cfg.c
+++ b/hw/nvram/fw_cfg.c
@@ -277,7 +277,8 @@ static int fw_cfg_select(FWCfgState *s, uint16_t key)
static uint8_t fw_cfg_read(FWCfgState *s)
{
int arch = !!(s->cur_entry & FW_CFG_ARCH_LOCAL);
- FWCfgEntry *e = &s->entries[arch][s->cur_entry & FW_CFG_ENTRY_MASK];
+ FWCfgEntry *e = (s->cur_entry == FW_CFG_INVALID) ? NULL :
+ &s->entries[arch][s->cur_entry & FW_CFG_ENTRY_MASK];
uint8_t ret;
if (s->cur_entry == FW_CFG_INVALID || !e->data || s->cur_offset >= e->len)
@@ -342,7 +343,8 @@ static void fw_cfg_dma_transfer(FWCfgState *s)
}
arch = !!(s->cur_entry & FW_CFG_ARCH_LOCAL);
- e = &s->entries[arch][s->cur_entry & FW_CFG_ENTRY_MASK];
+ e = (s->cur_entry == FW_CFG_INVALID) ? NULL :
+ &s->entries[arch][s->cur_entry & FW_CFG_ENTRY_MASK];
if (dma.control & FW_CFG_DMA_CTL_READ) {
read = 1;
--
1.8.3.1
- [Qemu-devel] [PULL 0/6] fw_cfg: doc updates, various optimizations., Gerd Hoffmann, 2015/12/17
- [Qemu-devel] [PULL 4/6] fw_cfg: avoid calculating invalid current entry pointer,
Gerd Hoffmann <=
- [Qemu-devel] [PULL 1/6] fw_cfg: move internal function call docs to header file, Gerd Hoffmann, 2015/12/17
- [Qemu-devel] [PULL 5/6] fw_cfg: add generic non-DMA read method, Gerd Hoffmann, 2015/12/17
- [Qemu-devel] [PULL 6/6] fw_cfg: replace ioport data read with generic method, Gerd Hoffmann, 2015/12/17
- [Qemu-devel] [PULL 2/6] fw_cfg: amend callback behavior spec to once per select, Gerd Hoffmann, 2015/12/17
- [Qemu-devel] [PULL 3/6] fw_cfg: remove offset argument from callback prototype, Gerd Hoffmann, 2015/12/17
- Re: [Qemu-devel] [PULL 0/6] fw_cfg: doc updates, various optimizations., Peter Maydell, 2015/12/17