Re: [Qemu-trivial] [PATCH v2 2/2] xen-pt: fix Out-of-bounds read

[Gonglei <arei.gonglei@huawei.com>]

On 2015/2/10 16:11, Stefano Stabellini wrote:
> On Tue, 10 Feb 2015, arei.gonglei@huawei.com wrote:
>> From: Gonglei <arei.gonglei@huawei.com>
>>
>> The array length of s->real_device.io_regions[] is
>> "PCI_NUM_REGIONS - 1".
>>
>> Signed-off-by: Gonglei <arei.gonglei@huawei.com>
> 
> Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
> 
> I am happy for these patches to go in via the qemu-trivial tree.
> 
Thanks. Let me cc /mjt.

Regards,
-Gonglei
>>  hw/xen/xen_pt_config_init.c | 2 +-
>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/hw/xen/xen_pt_config_init.c b/hw/xen/xen_pt_config_init.c
>> index 710fe50..d99c22e 100644
>> --- a/hw/xen/xen_pt_config_init.c
>> +++ b/hw/xen/xen_pt_config_init.c
>> @@ -438,7 +438,7 @@ static int xen_pt_bar_reg_read(XenPCIPassthroughState *s, XenPTReg *cfg_entry,
>>  
>>      /* get BAR index */
>>      index = xen_pt_bar_offset_to_index(reg->offset);
>> -    if (index < 0 || index >= PCI_NUM_REGIONS) {
>> +    if (index < 0 || index >= PCI_NUM_REGIONS - 1) {
>>          XEN_PT_ERR(&s->dev, "Internal error: Invalid BAR index [%d].\n", index);
>>          return -1;
>>      }
>> -- 
>> 1.7.12.4
>>
>>