Module Name: src
Committed By: bouyer
Date: Thu Mar 15 18:37:44 UTC 2012
Modified Files:
src/sys/dev/sdmmc: sdhc.c
Log Message:
Do not read past array end, found by gcc -O3.
This could cause to HWRITE4() a bad value, but maybe last 2 bytes are
probably ignored by hardware anyway.
To generate a diff of this commit:
cvs rdiff -u -r1.12 -r1.13 src/sys/dev/sdmmc/sdhc.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/dev/sdmmc/sdhc.c
diff -u src/sys/dev/sdmmc/sdhc.c:1.12 src/sys/dev/sdmmc/sdhc.c:1.13
--- src/sys/dev/sdmmc/sdhc.c:1.12 Fri Mar 2 18:20:33 2012
+++ src/sys/dev/sdmmc/sdhc.c Thu Mar 15 18:37:43 2012
@@ -1,4 +1,4 @@
-/* $NetBSD: sdhc.c,v 1.12 2012/03/02 18:20:33 nonaka Exp $ */
+/* $NetBSD: sdhc.c,v 1.13 2012/03/15 18:37:43 bouyer Exp $ */
/* $OpenBSD: sdhc.c,v 1.25 2009/01/13 19:44:20 grange Exp $ */
/*
@@ -23,7 +23,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: sdhc.c,v 1.12 2012/03/02 18:20:33 nonaka Exp $");
+__KERNEL_RCSID(0, "$NetBSD: sdhc.c,v 1.13 2012/03/15 18:37:43 bouyer Exp $");
#ifdef _KERNEL_OPT
#include "opt_sdmmc.h"
@@ -441,8 +441,10 @@ sdhc_suspend(device_t dev, const pmf_qua
uint32_t v = HREAD4(hp, i);
hp->regs[i + 0] = (v >> 0);
hp->regs[i + 1] = (v >> 8);
- hp->regs[i + 2] = (v >> 16);
- hp->regs[i + 3] = (v >> 24);
+ if (i + 3 < sizeof hp->regs) {
+ hp->regs[i + 2] = (v >> 16);
+ hp->regs[i + 3] = (v >> 24);
+ }
}
} else {
for (i = 0; i < sizeof hp->regs; i++) {
@@ -466,11 +468,17 @@ sdhc_resume(device_t dev, const pmf_qual
(void)sdhc_host_reset(hp);
if (ISSET(sc->sc_flags, SDHC_FLAG_32BIT_ACCESS)) {
for (i = 0; i < sizeof hp->regs; i += 4) {
- HWRITE4(hp, i,
- (hp->regs[i + 0] << 0)
- | (hp->regs[i + 1] << 8)
- | (hp->regs[i + 2] << 16)
- | (hp->regs[i + 3] << 24));
+ if (i + 3 < sizeof hp->regs) {
+ HWRITE4(hp, i,
+ (hp->regs[i + 0] << 0)
+ | (hp->regs[i + 1] << 8)
+ | (hp->regs[i + 2] << 16)
+ | (hp->regs[i + 3] << 24));
+ } else {
+ HWRITE4(hp, i,
+ (hp->regs[i + 0] << 0)
+ | (hp->regs[i + 1] << 8));
+ }
}
} else {
for (i = 0; i < sizeof hp->regs; i++) {
