diff options
| author | Peter Maydell <peter.maydell@linaro.org> | 2011-11-11 13:30:15 +0000 |
|---|---|---|
| committer | Anthony Liguori <aliguori@us.ibm.com> | 2011-11-11 12:49:53 -0600 |
| commit | ee71c984342408a357a74f65915bf66484ba445a (patch) | |
| tree | b719615c26caa08f3eb27bd77bbc7877579942cc /hw | |
| parent | afd4a65225318ec7900871ed69a46ce992637ef2 (diff) | |
| download | qemu-ee71c984342408a357a74f65915bf66484ba445a.zip qemu-ee71c984342408a357a74f65915bf66484ba445a.tar.gz qemu-ee71c984342408a357a74f65915bf66484ba445a.tar.bz2 | |
hw/arm_timer.c: Fix bounds check for Integrator timer accesses
There are only three counter/timers on the integrator board:
correct the bounds check to avoid an array overrun. (Spotted
by Coverity, see bug 887883).
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Diffstat (limited to 'hw')
| -rw-r--r-- | hw/arm_timer.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/hw/arm_timer.c b/hw/arm_timer.c index 09a4b24..66db81d 100644 --- a/hw/arm_timer.c +++ b/hw/arm_timer.c @@ -269,7 +269,7 @@ static uint64_t icp_pit_read(void *opaque, target_phys_addr_t offset, /* ??? Don't know the PrimeCell ID for this device. */ n = offset >> 8; - if (n > 3) { + if (n > 2) { hw_error("sp804_read: Bad timer %d\n", n); } @@ -283,7 +283,7 @@ static void icp_pit_write(void *opaque, target_phys_addr_t offset, int n; n = offset >> 8; - if (n > 3) { + if (n > 2) { hw_error("sp804_write: Bad timer %d\n", n); } |