Re: [Qemu-devel] [PATCH] qxl: Slot sanity check in qxl_phys2virt() is off by one, fix

[Alon Levy <alevy@redhat.com>]

On Tue, Jan 17, 2012 at 10:08:47AM +0100, Markus Armbruster wrote:
> Ping?
> 
> Markus Armbruster <armbru@redhat.com> writes:
> 

Reviewed-by: Alon Levy <alevy@redhat.com>

> > Spotted by Coverity.
> >
> > Signed-off-by: Markus Armbruster <armbru@redhat.com>
> > ---
> >  hw/qxl.c |    2 +-
> >  1 files changed, 1 insertions(+), 1 deletions(-)
> >
> > diff --git a/hw/qxl.c b/hw/qxl.c
> > index 84ffd45..c97bebe 100644
> > --- a/hw/qxl.c
> > +++ b/hw/qxl.c
> > @@ -1006,7 +1006,7 @@ void *qxl_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL pqxl, int group_id)
> >      case MEMSLOT_GROUP_HOST:
> >          return (void*)offset;
> >      case MEMSLOT_GROUP_GUEST:
> > -        PANIC_ON(slot > NUM_MEMSLOTS);
> > +        PANIC_ON(slot >= NUM_MEMSLOTS);
> >          PANIC_ON(!qxl->guest_slots[slot].active);
> >          PANIC_ON(offset < qxl->guest_slots[slot].delta);
> >          offset -= qxl->guest_slots[slot].delta;
>