From: Stefan Weil <sw@weilnetz.de>
Date: Sat, 1 Sep 2012 09:12:23 +0000 (+0200)
Subject: cadence_uart: Fix buffer overflow
X-Git-Tag: v1.2.1~23
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=96d90d32ac4f3f2d39e0df881e0a9b12007a6d0d;p=thirdparty%2Fqemu.git

cadence_uart: Fix buffer overflow

Report from smatch:
hw/cadence_uart.c:413 uart_read(13) error: buffer overflow 's->r' 18 <= 18

This fixes read access to s->r[R_MAX] which is behind the limits of s->r.

Signed-off-by: Stefan Weil <sw@weilnetz.de>
Signed-off-by: Stefan Hajnoczi <stefanha@gmail.com>
(cherry picked from commit 5d40097fc09fe5d34cf316a411dc27d455ac2cd0)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
---

diff --git a/hw/cadence_uart.c b/hw/cadence_uart.c
index d98e5313725..f8afc4ed262 100644
--- a/hw/cadence_uart.c
+++ b/hw/cadence_uart.c
@@ -404,7 +404,7 @@ static uint64_t uart_read(void *opaque, target_phys_addr_t offset,
     uint32_t c = 0;
 
     offset >>= 2;
-    if (offset > R_MAX) {
+    if (offset >= R_MAX) {
         return 0;
     } else if (offset == R_TX_RX) {
         uart_read_rx_fifo(s, &c);