From c47a80cd14309727f5a0a0eb0fd26d4aa1b5c14c Mon Sep 17 00:00:00 2001 From: Feng Jiang Date: Thu, 20 Apr 2023 10:21:13 +0100 Subject: [PATCH] exynos: Fix out-of-bounds access in exynos4210_gcomp_find debug printf One of the debug printfs in exynos4210_gcomp_find() will access outside the 's->g_timer.reg.comp[]' array if there was no active comparator and 'res' is -1. Add a conditional to avoid this. This doesn't happen in normal use because the debug printfs are by default not compiled in. Signed-off-by: Feng Jiang Message-id: 20230404074506.112615-1-jiangfeng@kylinos.cn Reviewed-by: Peter Maydell [PMM: Adjusted commit message to clarify that the overrun only happens if you've enabled debug printfs] Signed-off-by: Peter Maydell --- hw/timer/exynos4210_mct.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/hw/timer/exynos4210_mct.c b/hw/timer/exynos4210_mct.c index c17b247da3..446bbd2b96 100644 --- a/hw/timer/exynos4210_mct.c +++ b/hw/timer/exynos4210_mct.c @@ -480,11 +480,14 @@ static int32_t exynos4210_gcomp_find(Exynos4210MCTState *s) res = min_comp_i; } - DPRINTF("found comparator %d: comp 0x%llx distance 0x%llx, gfrc 0x%llx\n", - res, - s->g_timer.reg.comp[res], - distance_min, - gfrc); + if (res >= 0) { + DPRINTF("found comparator %d: " + "comp 0x%llx distance 0x%llx, gfrc 0x%llx\n", + res, + s->g_timer.reg.comp[res], + distance_min, + gfrc); + } return res; }