From patchwork Fri Nov 11 13:30:15 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Maydell X-Patchwork-Id: 5079 Return-Path: X-Original-To: patchwork@peony.canonical.com Delivered-To: patchwork@peony.canonical.com Received: from fiordland.canonical.com (fiordland.canonical.com [91.189.94.145]) by peony.canonical.com (Postfix) with ESMTP id DD79923E06 for ; Fri, 11 Nov 2011 13:30:19 +0000 (UTC) Received: from mail-fx0-f52.google.com (mail-fx0-f52.google.com [209.85.161.52]) by fiordland.canonical.com (Postfix) with ESMTP id B3383A18428 for ; Fri, 11 Nov 2011 13:30:19 +0000 (UTC) Received: by faan26 with SMTP id n26so5699503faa.11 for ; Fri, 11 Nov 2011 05:30:19 -0800 (PST) Received: by 10.152.162.10 with SMTP id xw10mr6732976lab.12.1321018219503; Fri, 11 Nov 2011 05:30:19 -0800 (PST) X-Forwarded-To: linaro-patchwork@canonical.com X-Forwarded-For: patch@linaro.org linaro-patchwork@canonical.com Delivered-To: patches@linaro.org Received: by 10.152.40.7 with SMTP id t7cs47720lak; Fri, 11 Nov 2011 05:30:19 -0800 (PST) Received: by 10.227.208.81 with SMTP id gb17mr7741481wbb.24.1321018217874; Fri, 11 Nov 2011 05:30:17 -0800 (PST) Received: from mnementh.archaic.org.uk (mnementh.archaic.org.uk. [81.2.115.146]) by mx.google.com with ESMTPS id ev7si6486965wbb.61.2011.11.11.05.30.17 (version=TLSv1/SSLv3 cipher=OTHER); Fri, 11 Nov 2011 05:30:17 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of pm215@archaic.org.uk designates 81.2.115.146 as permitted sender) client-ip=81.2.115.146; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of pm215@archaic.org.uk designates 81.2.115.146 as permitted sender) smtp.mail=pm215@archaic.org.uk Received: from pm215 by mnementh.archaic.org.uk with local (Exim 4.72) (envelope-from ) id 1ROrBP-0003aH-4r; Fri, 11 Nov 2011 13:30:15 +0000 From: Peter Maydell To: qemu-devel@nongnu.org Cc: patches@linaro.org Subject: [PATCH] hw/arm_timer.c: Fix bounds check for Integrator timer accesses Date: Fri, 11 Nov 2011 13:30:15 +0000 Message-Id: <1321018215-13754-1-git-send-email-peter.maydell@linaro.org> X-Mailer: git-send-email 1.7.2.5 There are only three counter/timers on the integrator board: correct the bounds check to avoid an array overrun. (Spotted by Coverity, see bug 887883). Signed-off-by: Peter Maydell --- hw/arm_timer.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/hw/arm_timer.c b/hw/arm_timer.c index 09a4b24..66db81d 100644 --- a/hw/arm_timer.c +++ b/hw/arm_timer.c @@ -269,7 +269,7 @@ static uint64_t icp_pit_read(void *opaque, target_phys_addr_t offset, /* ??? Don't know the PrimeCell ID for this device. */ n = offset >> 8; - if (n > 3) { + if (n > 2) { hw_error("sp804_read: Bad timer %d\n", n); } @@ -283,7 +283,7 @@ static void icp_pit_write(void *opaque, target_phys_addr_t offset, int n; n = offset >> 8; - if (n > 3) { + if (n > 2) { hw_error("sp804_write: Bad timer %d\n", n); }