On Mon, 2026-10-26 at 15:24 +0000, Peter Maydell wrote: > The xlnx_dp code has some assertions in its read and write functions > guarding the fallback "read from core_registers[]" codepath. The > array can't be overrun because of the defined size of the memory > region, but the read assert is confusingly written and the write > assert seems to be completely garbled. > > Replace both with a simple check against the size the array, which > makes it clear that we're asserting that we won't overflow it. > > Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4586 > Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Alistair Francis <[email protected]> Alistair > --- > hw/display/xlnx_dp.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/hw/display/xlnx_dp.c b/hw/display/xlnx_dp.c > index 06594980292..ad6c4952065 100644 > --- a/hw/display/xlnx_dp.c > +++ b/hw/display/xlnx_dp.c > @@ -812,10 +812,10 @@ static uint64_t xlnx_dp_read(void *opaque, > hwaddr offset, unsigned size) > ret = 0; > break; > default: > - assert(offset <= (0x3AC >> 2)); > if (offset == (0x3A8 >> 2) || offset == (0x3AC >> 2)) { > ret = s->core_registers[DP_INT_MASK]; > } else { > + assert(offset < ARRAY_SIZE(s->core_registers)); > ret = s->core_registers[offset]; > } > break; > @@ -986,7 +986,7 @@ static void xlnx_dp_write(void *opaque, hwaddr > offset, uint64_t value, > xlnx_dp_update_irq(s); > break; > default: > - assert(offset <= (0x504C >> 2)); > + assert(offset < ARRAY_SIZE(s->core_registers)); > s->core_registers[offset] = value; > break; > }
