From aa64cfaeb4ad0e67ccb54fa20511d7a36db9d833 Mon Sep 17 00:00:00 2001 From: Peter Maydell Date: Mon, 29 Apr 2019 17:35:57 +0100 Subject: hw/ssi/xilinx_spips: Avoid variable length array MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit In the stripe8() function we use a variable length array; however we know that the maximum length required is MAX_NUM_BUSSES. Use a fixed-length array and an assert instead. Signed-off-by: Peter Maydell Reviewed-by: Philippe Mathieu-Daudé Reviewed-by: Francisco Iglesias Reviewed-by: Alistair Francis Reviewed-by: Stefano Garzarella Message-id: 20190328152635.2794-1-peter.maydell@linaro.org --- hw/ssi/xilinx_spips.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'hw/ssi/xilinx_spips.c') diff --git a/hw/ssi/xilinx_spips.c b/hw/ssi/xilinx_spips.c index 16f88f7402..c615058cc1 100644 --- a/hw/ssi/xilinx_spips.c +++ b/hw/ssi/xilinx_spips.c @@ -429,12 +429,14 @@ static void xlnx_zynqmp_qspips_reset(DeviceState *d) static inline void stripe8(uint8_t *x, int num, bool dir) { - uint8_t r[num]; - memset(r, 0, sizeof(uint8_t) * num); + uint8_t r[MAX_NUM_BUSSES]; int idx[2] = {0, 0}; int bit[2] = {0, 7}; int d = dir; + assert(num <= MAX_NUM_BUSSES); + memset(r, 0, sizeof(uint8_t) * num); + for (idx[0] = 0; idx[0] < num; ++idx[0]) { for (bit[0] = 7; bit[0] >= 0; bit[0]--) { r[idx[!d]] |= x[idx[d]] & 1 << bit[d] ? 1 << bit[!d] : 0; -- cgit v1.2.3