@@ -103,19 +103,18 @@ static void edu_lower_irq(EduState *edu, uint32_t val)
}
}
-static bool within(uint64_t addr, uint64_t start, uint64_t end)
-{
- return start <= addr && addr < end;
-}
-
static void edu_check_range(uint64_t addr, uint64_t size1, uint64_t start,
uint64_t size2)
{
uint64_t end1 = addr + size1;
uint64_t end2 = start + size2;
- if (within(addr, start, end2) &&
- end1 > addr && within(end1, start, end2)) {
+ /*
+ * 1. ensure we aren't overflowing
+ * 2. ensure that [start, end2) is within [addr, end1)
+ */
+ if (end1 >= addr && end2 >= start && start >= addr && end2 <= end1)
+ {
return;
}
In the case that size1 was zero, because of the explicit 'end1 > addr' check, the range check would fail and the error message would read as shown below. The correct comparison is 'end1 >= addr' (or 'addr <= end1'). EDU: DMA range 0x40000-0x3ffff out of bounds (0x40000-0x3ffff)! At the opposite end, in the case that size1 was 4096, within() would fail because of the non-inclusive check 'end1 < end2', which should have been 'end1 <= end2'. The error message would previously say EDU: DMA range 0x40000-0x40fff out of bounds (0x40000-0x40fff)! Note: the original change (and error message) was when parameters were uint32_t. Signed-off-by: Chris Friedt <chrisfriedt@gmail.com> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1254 --- hw/misc/edu.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-)