The xlnx_dp code has some assertions in its read and write functions guarding the fallback "read from core_registers[]" codepath. The array can't be overrun because of the defined size of the memory region, but the read assert is confusingly written and the write assert seems to be completely garbled.
Replace both with a simple check against the size the array, which makes it clear that we're asserting that we won't overflow it. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4586 Signed-off-by: Peter Maydell <[email protected]> --- hw/display/xlnx_dp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/hw/display/xlnx_dp.c b/hw/display/xlnx_dp.c index 06594980292..ad6c4952065 100644 --- a/hw/display/xlnx_dp.c +++ b/hw/display/xlnx_dp.c @@ -812,10 +812,10 @@ static uint64_t xlnx_dp_read(void *opaque, hwaddr offset, unsigned size) ret = 0; break; default: - assert(offset <= (0x3AC >> 2)); if (offset == (0x3A8 >> 2) || offset == (0x3AC >> 2)) { ret = s->core_registers[DP_INT_MASK]; } else { + assert(offset < ARRAY_SIZE(s->core_registers)); ret = s->core_registers[offset]; } break; @@ -986,7 +986,7 @@ static void xlnx_dp_write(void *opaque, hwaddr offset, uint64_t value, xlnx_dp_update_irq(s); break; default: - assert(offset <= (0x504C >> 2)); + assert(offset < ARRAY_SIZE(s->core_registers)); s->core_registers[offset] = value; break; } -- 2.43.0
