| commit | f25c7ca0cecb71428f864b9ccb6f128ec39ea94e | |
| author | AlexChen <alex.chen@huawei.com> | |
| Tue, 3 Nov 2020 07:46:02 +0000 (3 15:46 +0800) | ||
| committer | Thomas Huth <thuth@redhat.com> | |
| Tue, 17 Nov 2020 08:45:24 +0000 (17 09:45 +0100) | ||
| tree | 8e1582cb19a2f1d180673c2bba965e6bbcbf6e7b | treesnapshot (tar.gz zip) |
| parent | 844d35b9c289dcc424baa4e4fcb38b19e914ce77 | commitdiff |
target/microblaze: Fix possible array out of bounds in mmu_write()
The size of env->mmu.regs is 3, but the range of 'rn' is [0, 5].
To avoid data access out of bounds, only if 'rn' is less than 3, we
can print env->mmu.regs[rn]. In other cases, we can print
env->mmu.regs[MMU_R_TLBX].
Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Alex Chen <alex.chen@huawei.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Message-Id: <5FA10ABA.1080109@huawei.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
The size of env->mmu.regs is 3, but the range of 'rn' is [0, 5].
To avoid data access out of bounds, only if 'rn' is less than 3, we
can print env->mmu.regs[rn]. In other cases, we can print
env->mmu.regs[MMU_R_TLBX].
Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Alex Chen <alex.chen@huawei.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Message-Id: <5FA10ABA.1080109@huawei.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
| target/microblaze/mmu.c | diffblobblamehistory |