From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([140.186.70.92]:52332) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RVH4d-0002O0-4h for qemu-devel@nongnu.org; Tue, 29 Nov 2011 01:21:47 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1RVH4c-0003fR-7M for qemu-devel@nongnu.org; Tue, 29 Nov 2011 01:21:47 -0500 From: David Gibson Date: Tue, 29 Nov 2011 17:21:39 +1100 Message-Id: <1322547699-28329-1-git-send-email-david@gibson.dropbear.id.au> Subject: [Qemu-devel] [PATCH] pseries: Fix array overrun bug in PCI code List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: agraf@suse.de Cc: aik@ozlabs.ru, sw@weilnetz.de, qemu-ppc@nongnu.org, qemu-devel@nongnu.org spapr_populate_pci_devices() containd a loop with PCI_NUM_REGIONS (7) iterations. However this overruns the 'bars' global array, which only has 6 elements. In fact we only want to run this loop for things listed in the bars array, so this patch corrects the loop bounds to reflect that. Signed-off-by: David Gibson --- hw/spapr_pci.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/hw/spapr_pci.c b/hw/spapr_pci.c index 7162588..9b6a032 100644 --- a/hw/spapr_pci.c +++ b/hw/spapr_pci.c @@ -454,7 +454,7 @@ int spapr_populate_pci_devices(sPAPRPHBState *phb, reg[0].size = 0; n = 0; - for (i = 0; i < PCI_NUM_REGIONS; ++i) { + for (i = 0; i < ARRAY_SIZE(bars); ++i) { if (0 == dev->io_regions[i].size) { continue; } -- 1.7.7.3