Re: [PATCH] target/microblaze: Fix possible array out of bounds in mmu_write()

On 2020/11/6 22:16, Philippe Mathieu-Daudé wrote: > On 11/3/20 8:46 AM, AlexChen wrote: >> The size of env->mmu.regs is 3, but the range of 'rn' is [0, 5]. >> To avoid data access out of bounds, only if 'rn' is less than 3, we >> can print env->mmu.regs[rn]. In other cases, we can print >> env->mmu

Re: [PATCH] target/microblaze: Fix possible array out of bounds in mmu_write()

On 11/3/20 8:46 AM, AlexChen wrote: > The size of env->mmu.regs is 3, but the range of 'rn' is [0, 5]. > To avoid data access out of bounds, only if 'rn' is less than 3, we > can print env->mmu.regs[rn]. In other cases, we can print > env->mmu.regs[MMU_R_TLBX]. > > Reported-by: Euler Robot > Sign

Re: [PATCH] target/microblaze: Fix possible array out of bounds in mmu_write()

On Tue, Nov 03, 2020 at 03:46:02PM +0800, AlexChen wrote: > The size of env->mmu.regs is 3, but the range of 'rn' is [0, 5]. > To avoid data access out of bounds, only if 'rn' is less than 3, we > can print env->mmu.regs[rn]. In other cases, we can print > env->mmu.regs[MMU_R_TLBX]. > > Reported-b

Re: [PATCH] target/microblaze: Fix possible array out of bounds in mmu_write()

On 03/11/2020 08.46, AlexChen wrote: > The size of env->mmu.regs is 3, but the range of 'rn' is [0, 5]. > To avoid data access out of bounds, only if 'rn' is less than 3, we > can print env->mmu.regs[rn]. In other cases, we can print > env->mmu.regs[MMU_R_TLBX]. ... since env->mmu.regs[MMU_R_TLBX]

[PATCH] target/microblaze: Fix possible array out of bounds in mmu_write()

The size of env->mmu.regs is 3, but the range of 'rn' is [0, 5]. To avoid data access out of bounds, only if 'rn' is less than 3, we can print env->mmu.regs[rn]. In other cases, we can print env->mmu.regs[MMU_R_TLBX]. Reported-by: Euler Robot Signed-off-by: Alex Chen --- target/microblaze/mmu.c