On 9/7/26 12:48, Peter Maydell wrote:
In allwinner_r40_ccu_write() we handle writes to a MemoryRegion of size AW_R40_CCU_IOSIZE, and the register array is sized accordingly at (AW_R40_CCU_IOSIZE / sizeof(uint32_t)). However, one of the cases in the switch is a range up to AW_R40_CCU_IOSIZE, which makes Coverity think we might index off the end of the array. We also have a similar case in the read function, but since that returns early it doesn't have the same issue.Adjust the handling of out of range accesses: - use AW_R40_CCU_IOSIZE - 4 as the upper bound, as this is the largest value we will actually see - return early in the write case, as we do in the read case Coverity CID: 1663687 Signed-off-by: Peter Maydell <[email protected]> --- hw/misc/allwinner-r40-ccu.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
