From ee71c984342408a357a74f65915bf66484ba445a Mon Sep 17 00:00:00 2001 From: Peter Maydell Date: Fri, 11 Nov 2011 13:30:15 +0000 Subject: [PATCH] hw/arm_timer.c: Fix bounds check for Integrator timer accesses There are only three counter/timers on the integrator board: correct the bounds check to avoid an array overrun. (Spotted by Coverity, see bug 887883). Signed-off-by: Peter Maydell Signed-off-by: Anthony Liguori --- hw/arm_timer.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/hw/arm_timer.c b/hw/arm_timer.c index 09a4b247bd..66db81d5b7 100644 --- a/hw/arm_timer.c +++ b/hw/arm_timer.c @@ -269,7 +269,7 @@ static uint64_t icp_pit_read(void *opaque, target_phys_addr_t offset, /* ??? Don't know the PrimeCell ID for this device. */ n = offset >> 8; - if (n > 3) { + if (n > 2) { hw_error("sp804_read: Bad timer %d\n", n); } @@ -283,7 +283,7 @@ static void icp_pit_write(void *opaque, target_phys_addr_t offset, int n; n = offset >> 8; - if (n > 3) { + if (n > 2) { hw_error("sp804_write: Bad timer %d\n", n); } -- 2.11.4.GIT