[Qemu-devel] [PULL] tiny spice patch queue

[Qemu-devel] [PULL] tiny spice patch queue

[Gerd Hoffmann]

  Hi,

please pull a qxl bugfix.

thanks,
  Gerd

The following changes since commit 515aa3c57986b3e26558d72ecaeb7545ecd30510:

  check-qstring: remove check.h include (2012-01-12 11:33:22 -0600)

are available in the git repository at:
  git://anongit.freedesktop.org/spice/qemu spice.v47

Markus Armbruster (1):
      qxl: Slot sanity check in qxl_phys2virt() is off by one, fix

 hw/qxl.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

[Qemu-devel] [PATCH] qxl: Slot sanity check in qxl_phys2virt() is off by one, fix

[Gerd Hoffmann]

From: Markus Armbruster <armbru@redhat.com>

Spotted by Coverity.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
 hw/qxl.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/hw/qxl.c b/hw/qxl.c
index ac81927..bdd36f9 100644
--- a/hw/qxl.c
+++ b/hw/qxl.c
@@ -1020,7 +1020,7 @@ void *qxl_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL pqxl, int group_id)
     case MEMSLOT_GROUP_HOST:
         return (void*)offset;
     case MEMSLOT_GROUP_GUEST:
-        PANIC_ON(slot > NUM_MEMSLOTS);
+        PANIC_ON(slot >= NUM_MEMSLOTS);
         PANIC_ON(!qxl->guest_slots[slot].active);
         PANIC_ON(offset < qxl->guest_slots[slot].delta);
         offset -= qxl->guest_slots[slot].delta;
-- 
1.7.1

Re: [Qemu-devel] [PULL] tiny spice patch queue

[Anthony Liguori]

On 01/17/2012 09:51 AM, Gerd Hoffmann wrote:
>    Hi,
>
> please pull a qxl bugfix.

Pulled.  Thanks.

Regards,

Anthony Liguori

>
> thanks,
>    Gerd
>
> The following changes since commit 515aa3c57986b3e26558d72ecaeb7545ecd30510:
>
>    check-qstring: remove check.h include (2012-01-12 11:33:22 -0600)
>
> are available in the git repository at:
>    git://anongit.freedesktop.org/spice/qemu spice.v47
>
> Markus Armbruster (1):
>        qxl: Slot sanity check in qxl_phys2virt() is off by one, fix
>
>   hw/qxl.c |    2 +-
>   1 files changed, 1 insertions(+), 1 deletions(-)
>
>