From: Bernhard Beschow <[email protected]> Calculate mailbox indices from the `mbs[]` array layout instead of the oversized raw `mb[]` view. This prevents accessing mailbox entries beyond the valid array range and fixes Coverity CID 1662974.
Reported-by: Peter Maydell <[email protected]> Signed-off-by: Bernhard Beschow <[email protected]> Tested-by: Pavel Pisa <[email protected]> Reviewed-by: Peter Maydell <[email protected]> Message-id: [email protected] Signed-off-by: Peter Maydell <[email protected]> --- hw/net/can/flexcan.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/hw/net/can/flexcan.c b/hw/net/can/flexcan.c index 651904fa379..8d680f1832e 100644 --- a/hw/net/can/flexcan.c +++ b/hw/net/can/flexcan.c @@ -1239,14 +1239,12 @@ static void flexcan_mem_write(void *opaque, hwaddr addr, uint64_t val, static uint64_t flexcan_mem_read(void *opqaue, hwaddr addr, unsigned size) { FlexcanState *s = opqaue; + const int mbid = (addr - offsetof(FlexcanRegs, mbs)) / + sizeof(s->regs.mbs[0]); uint32_t rv = s->regs_raw[addr >> 2]; - if (addr >= offsetof(FlexcanRegs, mb) && - addr < offsetof(FlexcanRegs, _reserved4)) { + if (0 <= mbid && mbid < ARRAY_SIZE(s->regs.mbs)) { /* reading from mailbox */ - hwaddr offset = addr - offsetof(FlexcanRegs, mb); - int mbid = offset / sizeof(FlexcanRegsMessageBuffer); - if (addr % 16 == 0 && s->locked_mbidx != mbid) { /* reading control word locks the mailbox */ flexcan_mb_unlock(s); -- 2.43.0
