From: AlexChen Date: Tue, 3 Nov 2020 07:46:02 +0000 (+0800) Subject: target/microblaze: Fix possible array out of bounds in mmu_write() X-Git-Tag: v5.2.0~32^2~5 X-Git-Url: https://git.proxmox.com/?a=commitdiff_plain;h=f25c7ca0cecb71428f864b9ccb6f128ec39ea94e;p=mirror_qemu.git target/microblaze: Fix possible array out of bounds in mmu_write() The size of env->mmu.regs is 3, but the range of 'rn' is [0, 5]. To avoid data access out of bounds, only if 'rn' is less than 3, we can print env->mmu.regs[rn]. In other cases, we can print env->mmu.regs[MMU_R_TLBX]. Reported-by: Euler Robot Signed-off-by: Alex Chen Reviewed-by: Thomas Huth Reviewed-by: Edgar E. Iglesias Message-Id: <5FA10ABA.1080109@huawei.com> Signed-off-by: Thomas Huth --- diff --git a/target/microblaze/mmu.c b/target/microblaze/mmu.c index 2baaef7545..1e426963ba 100644 --- a/target/microblaze/mmu.c +++ b/target/microblaze/mmu.c @@ -234,7 +234,8 @@ void mmu_write(CPUMBState *env, bool ext, uint32_t rn, uint32_t v) unsigned int i; qemu_log_mask(CPU_LOG_MMU, - "%s rn=%d=%x old=%x\n", __func__, rn, v, env->mmu.regs[rn]); + "%s rn=%d=%x old=%x\n", __func__, rn, v, + rn < 3 ? env->mmu.regs[rn] : env->mmu.regs[MMU_R_TLBX]); if (cpu->cfg.mmu < 2 || !cpu->cfg.mmu_tlb_access) { qemu_log_mask(LOG_GUEST_ERROR, "MMU access on MMU-less system\n");