From nobody Mon Feb 9 14:35:17 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1680617554390112.9770392549691; Tue, 4 Apr 2023 07:12:34 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1pjhNc-0002Xk-BF; Tue, 04 Apr 2023 10:11:24 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1pjbMN-0000r7-1J; Tue, 04 Apr 2023 03:45:44 -0400 Received: from mailgw.kylinos.cn ([124.126.103.232]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1pjbMI-0007VI-Jg; Tue, 04 Apr 2023 03:45:42 -0400 Received: from localhost.localdomain [(116.128.244.169)] by mailgw (envelope-from ) (Generic MTA with TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 256/256) with ESMTP id 631463944; Tue, 04 Apr 2023 15:45:21 +0800 X-UUID: 7109e155d15f4e1d9b90988a8f9b9732-20230404 X-CID-O-RULE: Release_Ham X-CID-RULE: Release_Ham X-CID-O-INFO: VERSION:1.1.22, REQID:c230e7ff-7383-4e37-9e3d-befd4212d63f, IP:15, URL:0,TC:0,Content:0,EDM:25,RT:0,SF:-5,FILE:0,BULK:0,RULE:Release_Ham,ACTI ON:release,TS:35 X-CID-INFO: VERSION:1.1.22, REQID:c230e7ff-7383-4e37-9e3d-befd4212d63f, IP:15, UR L:0,TC:0,Content:0,EDM:25,RT:0,SF:-5,FILE:0,BULK:0,RULE:Release_Ham,ACTION :release,TS:35 X-CID-META: VersionHash:120426c, CLOUDID:fcfcc3f7-ddba-41c3-91d9-10eeade8eac7, B ulkID:2304041545233UXU9CEP,BulkQuantity:0,Recheck:0,SF:38|24|17|19|44|102, TC:nil,Content:0,EDM:5,IP:-2,URL:0,File:nil,Bulk:nil,QS:nil,BEC:nil,COL:0, OSI:0,OSA:0,AV:0 X-CID-BVR: 0,NGT X-CID-BAS: 0,NGT,0,_ X-UUID: 7109e155d15f4e1d9b90988a8f9b9732-20230404 X-User: jiangfeng@kylinos.cn From: Feng Jiang To: i.mitsyanko@gmail.com, peter.maydell@linaro.org Cc: qemu-arm@nongnu.org, qemu-devel@nongnu.org, Feng Jiang Subject: [PATCH] exynos: Fix out-of-bounds access in exynos4210_gcomp_find Date: Tue, 4 Apr 2023 15:45:06 +0800 Message-Id: <20230404074506.112615-1-jiangfeng@kylinos.cn> X-Mailer: git-send-email 2.39.2 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=124.126.103.232; envelope-from=jiangfeng@kylinos.cn; helo=mailgw.kylinos.cn X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-Mailman-Approved-At: Tue, 04 Apr 2023 10:11:21 -0400 X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZM-MESSAGEID: 1680617556778100003 Content-Type: text/plain; charset="utf-8" When 'res' equals -1, the array 's->g_timer.reg.comp[]' is accessed out of bounds. Signed-off-by: Feng Jiang --- hw/timer/exynos4210_mct.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/hw/timer/exynos4210_mct.c b/hw/timer/exynos4210_mct.c index c17b247da3..446bbd2b96 100644 --- a/hw/timer/exynos4210_mct.c +++ b/hw/timer/exynos4210_mct.c @@ -480,11 +480,14 @@ static int32_t exynos4210_gcomp_find(Exynos4210MCTSta= te *s) res =3D min_comp_i; } =20 - DPRINTF("found comparator %d: comp 0x%llx distance 0x%llx, gfrc 0x%llx= \n", - res, - s->g_timer.reg.comp[res], - distance_min, - gfrc); + if (res >=3D 0) { + DPRINTF("found comparator %d: " + "comp 0x%llx distance 0x%llx, gfrc 0x%llx\n", + res, + s->g_timer.reg.comp[res], + distance_min, + gfrc); + } =20 return res; } --=20 2.39.2