mirrors
/
qemu
mirror of https://gitlab.com/qemu-project/qemu
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

nvic: Fix miscalculation of offsets into ITNS array 

This calculation of the first exception vector in
the ITNS<n> register being accessed:
        int startvec = 32 * (offset - 0x380) + NVIC_FIRST_IRQ;

is incorrect, because offset is in bytes, so we only want
to multiply by 8.

Spotted by Coverity (CID 1381484, CID 1381488), though it is
not correct that it actually overflows the buffer, because
we have a 'startvec + i < s->num_irq' guard.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1507650856-11718-1-git-send-email-peter.maydell@linaro.org
This commit is contained in:
Peter Maydell 2017-10-10 16:54:16 +01:00
parent a94bb9cd58
commit cf5f7937b0
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
hw/intc/armv7m_nvic.c
View File

@ -698,7 +698,7 @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
return ((s->num_irq - NVIC_FIRST_IRQ) / 32) - 1; return ((s->num_irq - NVIC_FIRST_IRQ) / 32) - 1;
case 0x380 ... 0x3bf: /* NVIC_ITNS<n> */ case 0x380 ... 0x3bf: /* NVIC_ITNS<n> */
{ {
int startvec = 32 * (offset - 0x380) + NVIC_FIRST_IRQ; int startvec = 8 * (offset - 0x380) + NVIC_FIRST_IRQ;
int i; int i;
if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) { if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
@ -1102,7 +1102,7 @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
switch (offset) { switch (offset) {
case 0x380 ... 0x3bf: /* NVIC_ITNS<n> */ case 0x380 ... 0x3bf: /* NVIC_ITNS<n> */
{ {
int startvec = 32 * (offset - 0x380) + NVIC_FIRST_IRQ; int startvec = 8 * (offset - 0x380) + NVIC_FIRST_IRQ;
int i; int i;
if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) { if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {