NetBSD-Bugs archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

kern/46200: read array past end in drm/dist/shared-core/i915_suspend.c

>Number:         46200
>Category:       kern
>Synopsis:       read array past end in drm/dist/shared-core/i915_suspend.c
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Mar 15 18:50:00 +0000 2012
>Release:        NetBSD 6.0_BETA
System: NetBSD 6.0_BETA NetBSD 6.0_BETA (XEN3PAE_DOMU) i386
Architecture: i386
Machine: i386
        in sys/external/bsd/drm/dist/shared-core/i915_suspend.c, line 510-517:
        /* Memory arbitration state */
        I915_WRITE (MI_ARB_STATE, dev_priv->saveMI_ARB_STATE | 0xffff0000);

        for (i = 0; i < 16; i++) {
                I915_WRITE(SWF00 + (i << 2), dev_priv->saveSWF0[i]);
                I915_WRITE(SWF10 + (i << 2), dev_priv->saveSWF1[i+7]);

but saveSWF1 is a 16-elements array; so saveSWF1[i+7] will obviously
read wronf data.

        code inspection (or gcc -03).
        I don't know if the loop bound should be changed, or if
        saveSWF1[i+7] should be saveSWF1[i] (or something else)

Home | Main Index | Thread Index | Old Index