Fix segfault when accessing bad memory addresses

diff --git a/riscv/devices.cc b/riscv/devices.cc
index af4dc7d127bc52684866e3be3ac5134e531e61f8..15115c8a6ccd5ec13ece8c125c8625fad7cd55be 100644 (file)
--- a/riscv/devices.cc
+++ b/riscv/devices.cc
@@ -21,13 +21,10 @@ bool bus_t::store(reg_t addr, size_t len, const uint8_t* bytes)
   return it->second->store(addr - -it->first, len, bytes);
 }
 
-bus_t::descriptor bus_t::find_device(reg_t addr)
+std::pair<reg_t, abstract_device_t*> bus_t::find_device(reg_t addr)
 {
   auto it = devices.lower_bound(-addr);
-  if (it == devices.end()) {
-    bus_t::descriptor desc = {0, 0};
-    return desc;
-  }
-  bus_t::descriptor desc = {-it->first, it->second};
-  return desc;
+  if (it == devices.end() || addr < -it->first)
+    return std::make_pair((reg_t)0, (abstract_device_t*)NULL);
+  return std::make_pair(-it->first, it->second);
 }

diff --git a/riscv/devices.h b/riscv/devices.h
index ba344dbdb8dc821269eff074a5ab9720eb8118dd..0f0c9166b7c7cb510a98d2b817ec25233e5d1da8 100644 (file)
--- a/riscv/devices.h
+++ b/riscv/devices.h
@@ -20,8 +20,7 @@ class bus_t : public abstract_device_t {
   bool store(reg_t addr, size_t len, const uint8_t* bytes);
   void add_device(reg_t addr, abstract_device_t* dev);
 
-  struct descriptor { reg_t base; abstract_device_t* device; };
-  descriptor find_device(reg_t addr);
+  std::pair<reg_t, abstract_device_t*> find_device(reg_t addr);
 
  private:
   std::map<reg_t, abstract_device_t*> devices;

diff --git a/riscv/sim.cc b/riscv/sim.cc
index ebf94b6ad57d43a93b4e30d4e33db0241e1b81fb..edf0819369cc084fd63730fe373594cd28b96e5a 100644 (file)
--- a/riscv/sim.cc
+++ b/riscv/sim.cc
@@ -317,8 +317,9 @@ void sim_t::make_dtb()
 
 char* sim_t::addr_to_mem(reg_t addr) {
   auto desc = bus.find_device(addr);
-  if (auto mem = dynamic_cast<mem_t*>(desc.device))
-    return mem->contents() + (addr - desc.base);
+  if (auto mem = dynamic_cast<mem_t*>(desc.second))
+    if (addr - desc.first < mem->size())
+      return mem->contents() + (addr - desc.first);
   return NULL;
 }