From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([140.186.70.92]:60912) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RMGAP-0007KP-5c for qemu-devel@nongnu.org; Fri, 04 Nov 2011 05:34:29 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1RMGAO-0005Mr-6s for qemu-devel@nongnu.org; Fri, 04 Nov 2011 05:34:29 -0400 Received: from oxygen.pond.sub.org ([78.46.104.156]:46816) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RMGAO-0005MS-2J for qemu-devel@nongnu.org; Fri, 04 Nov 2011 05:34:28 -0400 Received: from blackfin.pond.sub.org (p5B32A39D.dip.t-dialin.net [91.50.163.157]) by oxygen.pond.sub.org (Postfix) with ESMTPA id CCF86A3FC8 for ; Fri, 4 Nov 2011 10:34:24 +0100 (CET) From: Markus Armbruster Date: Fri, 4 Nov 2011 10:34:24 +0100 Message-Id: <1320399264-28581-1-git-send-email-armbru@redhat.com> Subject: [Qemu-devel] [PATCH] qxl: Slot sanity check in qxl_phys2virt() is off by one, fix List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: kraxel@redhat.com Spotted by Coverity. Signed-off-by: Markus Armbruster --- hw/qxl.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/hw/qxl.c b/hw/qxl.c index 84ffd45..c97bebe 100644 --- a/hw/qxl.c +++ b/hw/qxl.c @@ -1006,7 +1006,7 @@ void *qxl_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL pqxl, int group_id) case MEMSLOT_GROUP_HOST: return (void*)offset; case MEMSLOT_GROUP_GUEST: - PANIC_ON(slot > NUM_MEMSLOTS); + PANIC_ON(slot >= NUM_MEMSLOTS); PANIC_ON(!qxl->guest_slots[slot].active); PANIC_ON(offset < qxl->guest_slots[slot].delta); offset -= qxl->guest_slots[slot].delta; -- 1.7.6.4