The clock mux control registers in bcm2835_cprman have a 4 bit SRC field that selects the input clock source to use. There are only 10 valid SRC values. Treat the invalid values as producing no clock output, as if the GND clock source was used or the mux was disabled. This avoids reading off the end of the mux->srcs[] array.
Cc: [email protected] Fixes: fc9840850ba ("hw/misc/bcm2835_cprman: implement clock mux behaviour") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4695 Signed-off-by: Peter Maydell <[email protected]> --- hw/misc/bcm2835_cprman.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/misc/bcm2835_cprman.c b/hw/misc/bcm2835_cprman.c index f9a77ff9bb0..10cad07623d 100644 --- a/hw/misc/bcm2835_cprman.c +++ b/hw/misc/bcm2835_cprman.c @@ -271,7 +271,7 @@ static void clock_mux_update(CprmanClockMuxState *mux) *mux->reg_ctl = FIELD_DP32(*mux->reg_ctl, CM_CLOCKx_CTL, BUSY, enabled); - if (!enabled) { + if (!enabled || src >= ARRAY_SIZE(mux->srcs)) { clock_update(mux->out, 0); return; } -- 2.43.0
