Commit f3d8b1eb105199a1d6bf063a8a574e782689909a

Authored by aurel32
1 parent 563e3c6e

array overflow in hw/stellaris.c and hw/omap_dss.c

(Jindrich Makovicka)

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5064 c046a42c-6fe2-441c-8c8c-71466251a162
hw/omap_dss.c
... ... @@ -53,7 +53,7 @@ struct omap_dss_s {
53 53 uint32_t control;
54 54 uint32_t config;
55 55 uint32_t capable;
56   - uint32_t timing[3];
  56 + uint32_t timing[4];
57 57 int line;
58 58 uint32_t bg[2];
59 59 uint32_t trans[2];
... ... @@ -148,6 +148,7 @@ void omap_dss_reset(struct omap_dss_s *s)
148 148 s->dispc.timing[0] = 0;
149 149 s->dispc.timing[1] = 0;
150 150 s->dispc.timing[2] = 0;
  151 + s->dispc.timing[3] = 0;
151 152 s->dispc.line = 0;
152 153 s->dispc.bg[0] = 0;
153 154 s->dispc.bg[1] = 0;
... ...
hw/stellaris.c
... ... @@ -1308,8 +1308,8 @@ static void stellaris_init(const char *kernel_filename, const char *cpu_model,
1308 1308 static const int gpio_irq[7] = {0, 1, 2, 3, 4, 30, 31};
1309 1309  
1310 1310 qemu_irq *pic;
1311   - qemu_irq *gpio_in[5];
1312   - qemu_irq *gpio_out[5];
  1311 + qemu_irq *gpio_in[7];
  1312 + qemu_irq *gpio_out[7];
1313 1313 qemu_irq adc;
1314 1314 int sram_size;
1315 1315 int flash_size;
... ...