mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fw_cfg: avoid calculating invalid current entry pointer

Browse Source 
When calculating a pointer to the currently selected fw_cfg item, the
following is used:

  FWCfgEntry *e = &s->entries[arch][s->cur_entry & FW_CFG_ENTRY_MASK];

When s->cur_entry is FW_CFG_INVALID, we are calculating the address of
a non-existent element in s->entries[arch][...], which is undefined.

This patch ensures the resulting entry pointer is set to NULL whenever
s->cur_entry is FW_CFG_INVALID.

Reported-by: Laszlo Ersek <lersek@redhat.com>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
Signed-off-by: Gabriel Somlo <somlo@cmu.edu>
Message-id: 1446733972-1602-5-git-send-email-somlo@cmu.edu
Cc: Marc Marí <markmb@redhat.com>
Signed-off-by: Gabriel Somlo <somlo@cmu.edu>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
This commit is contained in:
Gabriel L. Somlo 2015-11-05 09:32:50 -05:00 committed by Gerd Hoffmann
parent 3f8752b4e5
commit 66f8fd9dda
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
hw/nvram/fw_cfg.c
View File

@ -277,7 +277,8 @@ static int fw_cfg_select(FWCfgState *s, uint16_t key)
static uint8_t fw_cfg_read(FWCfgState *s) static uint8_t fw_cfg_read(FWCfgState *s)
{ {
int arch = !!(s->cur_entry & FW_CFG_ARCH_LOCAL); int arch = !!(s->cur_entry & FW_CFG_ARCH_LOCAL);
FWCfgEntry *e = &s->entries[arch][s->cur_entry & FW_CFG_ENTRY_MASK]; FWCfgEntry *e = (s->cur_entry == FW_CFG_INVALID) ? NULL :
&s->entries[arch][s->cur_entry & FW_CFG_ENTRY_MASK];
uint8_t ret; uint8_t ret;
if (s->cur_entry == FW_CFG_INVALID || !e->data || s->cur_offset >= e->len) if (s->cur_entry == FW_CFG_INVALID || !e->data || s->cur_offset >= e->len)
@ -342,7 +343,8 @@ static void fw_cfg_dma_transfer(FWCfgState *s)
} }
arch = !!(s->cur_entry & FW_CFG_ARCH_LOCAL); arch = !!(s->cur_entry & FW_CFG_ARCH_LOCAL);
e = &s->entries[arch][s->cur_entry & FW_CFG_ENTRY_MASK]; e = (s->cur_entry == FW_CFG_INVALID) ? NULL :
&s->entries[arch][s->cur_entry & FW_CFG_ENTRY_MASK];
if (dma.control & FW_CFG_DMA_CTL_READ) { if (dma.control & FW_CFG_DMA_CTL_READ) {
read = 1; read = 1;