On Thu, Jul 9, 2026 at 1:03 PM Philippe Mathieu-Daudé < [email protected]> wrote:
> On 9/7/26 12:48, Peter Maydell wrote: > > In allwinner_r40_ccu_write() we handle writes to a MemoryRegion of > > size AW_R40_CCU_IOSIZE, and the register array is sized accordingly > > at (AW_R40_CCU_IOSIZE / sizeof(uint32_t)). However, one of the cases > > in the switch is a range up to AW_R40_CCU_IOSIZE, which makes > > Coverity think we might index off the end of the array. We also > > have a similar case in the read function, but since that returns > > early it doesn't have the same issue. > > > > Adjust the handling of out of range accesses: > > - use AW_R40_CCU_IOSIZE - 4 as the upper bound, as this is the > > largest value we will actually see > > - return early in the write case, as we do in the read case > > > > Coverity CID: 1663687 > > Signed-off-by: Peter Maydell <[email protected]> > > --- > > hw/misc/allwinner-r40-ccu.c | 6 +++--- > > 1 file changed, 3 insertions(+), 3 deletions(-) > > Reviewed-by: Philippe Mathieu-Daudé <[email protected]> > Reviewed-by: Strahinja Jankovic <[email protected]>
