From: Peter Maydell <[email protected]> The clock mux control registers in bcm2835_cprman have a 4 bit SRC field that selects the input clock source to use. There are only 10 valid SRC values. Treat the invalid values as producing no clock output, as if the GND clock source was used or the mux was disabled. This avoids reading off the end of the mux->srcs[] array.
Cc: [email protected] Fixes: fc9840850ba ("hw/misc/bcm2835_cprman: implement clock mux behaviour") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4695 Signed-off-by: Peter Maydell <[email protected]> Reviewed-by: Philippe Mathieu-Daudé <[email protected]> Reviewed-by: Luc Michel <[email protected]> Message-id: [email protected] (cherry picked from commit be67e61e29a8e432a563489eb38f44a218af8a44) Signed-off-by: Michael Tokarev <[email protected]> diff --git a/hw/misc/bcm2835_cprman.c b/hw/misc/bcm2835_cprman.c index 0c4d4b7de50..55c11f0c784 100644 --- a/hw/misc/bcm2835_cprman.c +++ b/hw/misc/bcm2835_cprman.c @@ -271,7 +271,7 @@ static void clock_mux_update(CprmanClockMuxState *mux) *mux->reg_ctl = FIELD_DP32(*mux->reg_ctl, CM_CLOCKx_CTL, BUSY, enabled); - if (!enabled) { + if (!enabled || src >= ARRAY_SIZE(mux->srcs)) { clock_update(mux->out, 0); return; } -- 2.47.3
