NetBSD-Bugs archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

kern/46196: array overflow in sys/external/bsd/drm/dist/shared-core/i915_suspend.c

>Number:         46196
>Category:       kern
>Synopsis:       array overflow in 
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Mar 14 21:00:00 +0000 2012
>Release:        NetBSD 6.0_BETA
System: NetBSD 6.0_BETA NetBSD 6.0_BETA (XEN3PAE_DOMU) i386
Architecture: i386
Machine: i386
        building an amd64 GENERIC kernel with -03, I got:
 In function 'i915_restore_state':
 error: array subscript is above array bounds

        indeed we have:
        for (i = 0; i < 16; i++) {
                I915_WRITE(SWF00 + (i << 2), dev_priv->saveSWF0[i]);
                I915_WRITE(SWF10 + (i << 2), dev_priv->saveSWF1[i+7]);

        but saveSWF1[] has only 16 elements. So there's obviously something
        wrong, but I don't know what ...

        builds amd64 GENERIC with -O3

Home | Main Index | Thread Index | Old Index