| Message ID | 1463075272-9933-2-git-send-email-peter.maydell@linaro.org (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
Le 12/05/2016 à 19:47, Peter Maydell a écrit : > From: Timothy E Baldwin <T.E.Baldwin99@members.leeds.ac.uk> > > Check array bounds in host_to_target_errno() and target_to_host_errno(). > > Signed-off-by: Timothy Edward Baldwin <T.E.Baldwin99@members.leeds.ac.uk> > Message-id: 1441497448-32489-2-git-send-email-T.E.Baldwin99@members.leeds.ac.uk > [PMM: Add a lower-bound check, use braces on if(), tweak commit message] > Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Laurent Vivier <laurent@vivier.eu> > --- > linux-user/syscall.c | 8 ++++++-- > 1 file changed, 6 insertions(+), 2 deletions(-) > > diff --git a/linux-user/syscall.c b/linux-user/syscall.c > index 032d338..5246f36 100644 > --- a/linux-user/syscall.c > +++ b/linux-user/syscall.c > @@ -619,15 +619,19 @@ static uint16_t host_to_target_errno_table[ERRNO_TABLE_SIZE] = { > > static inline int host_to_target_errno(int err) > { > - if(host_to_target_errno_table[err]) > + if (err >= 0 && err < ERRNO_TABLE_SIZE && > + host_to_target_errno_table[err]) { > return host_to_target_errno_table[err]; > + } > return err; > } > > static inline int target_to_host_errno(int err) > { > - if (target_to_host_errno_table[err]) > + if (err >= 0 && err < ERRNO_TABLE_SIZE && > + target_to_host_errno_table[err]) { > return target_to_host_errno_table[err]; > + } > return err; > } > >
diff --git a/linux-user/syscall.c b/linux-user/syscall.c index 032d338..5246f36 100644 --- a/linux-user/syscall.c +++ b/linux-user/syscall.c @@ -619,15 +619,19 @@ static uint16_t host_to_target_errno_table[ERRNO_TABLE_SIZE] = { static inline int host_to_target_errno(int err) { - if(host_to_target_errno_table[err]) + if (err >= 0 && err < ERRNO_TABLE_SIZE && + host_to_target_errno_table[err]) { return host_to_target_errno_table[err]; + } return err; } static inline int target_to_host_errno(int err) { - if (target_to_host_errno_table[err]) + if (err >= 0 && err < ERRNO_TABLE_SIZE && + target_to_host_errno_table[err]) { return target_to_host_errno_table[err]; + } return err; }