From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([2001:4830:134:3::10]:34518)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <marcel.apfelbaum@gmail.com>) id 1XJktV-00081H-H1
	for qemu-devel@nongnu.org; Tue, 19 Aug 2014 11:00:25 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <marcel.apfelbaum@gmail.com>) id 1XJktP-0007C9-Kw
	for qemu-devel@nongnu.org; Tue, 19 Aug 2014 11:00:17 -0400
Received: from mail-wg0-x22a.google.com ([2a00:1450:400c:c00::22a]:48790)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <marcel.apfelbaum@gmail.com>) id 1XJktP-0007Bt-EB
	for qemu-devel@nongnu.org; Tue, 19 Aug 2014 11:00:11 -0400
Received: by mail-wg0-f42.google.com with SMTP id l18so6370105wgh.13
	for <qemu-devel@nongnu.org>; Tue, 19 Aug 2014 08:00:10 -0700 (PDT)
Message-ID: <1408460386.13594.32.camel@localhost.localdomain>
From: Marcel Apfelbaum <marcel.apfelbaum@gmail.com>
Date: Tue, 19 Aug 2014 17:59:46 +0300
In-Reply-To: <1408432724-15676-1-git-send-email-arei.gonglei@huawei.com>
References: <1408432724-15676-1-git-send-email-arei.gonglei@huawei.com>
Content-Type: text/plain; charset="UTF-8"
Mime-Version: 1.0
Content-Transfer-Encoding: 7bit
Subject: Re: [Qemu-devel] [PATCH] pcihp: fix possible array out of bounds
Reply-To: marcel.a@redhat.com
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: arei.gonglei@huawei.com
Cc: weidong.huang@huawei.com, qemu-devel@nongnu.org, mst@redhat.com

On Tue, 2014-08-19 at 15:18 +0800, arei.gonglei@huawei.com wrote:
> From: Gonglei <arei.gonglei@huawei.com>
> 
> When 'bsel == ACPI_PCIHP_MAX_HOTPLUG_BUS', the
> s->acpi_pcihp_pci_status[bsel] array will out of bounds.
I would change the commit message to something like
"Prevent out-of-bounds array access on acpi_pcihp_pci_status.

Other than that, it looks OK to me.
Thanks,
Marcel

> 
> Add check for this.
> 
> Signed-off-by: Gonglei <arei.gonglei@huawei.com>
> ---
>  hw/acpi/pcihp.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/hw/acpi/pcihp.c b/hw/acpi/pcihp.c
> index fae663a..34dedf1 100644
> --- a/hw/acpi/pcihp.c
> +++ b/hw/acpi/pcihp.c
> @@ -231,7 +231,7 @@ static uint64_t pci_read(void *opaque, hwaddr addr, unsigned int size)
>      uint32_t val = 0;
>      int bsel = s->hotplug_select;
>  
> -    if (bsel < 0 || bsel > ACPI_PCIHP_MAX_HOTPLUG_BUS) {
> +    if (bsel < 0 || bsel >= ACPI_PCIHP_MAX_HOTPLUG_BUS) {
>          return 0;
>      }
>