From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([140.186.70.92]:46318) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RnBJv-0001AF-Iq for qemu-devel@nongnu.org; Tue, 17 Jan 2012 10:51:41 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1RnBJo-0003ka-F9 for qemu-devel@nongnu.org; Tue, 17 Jan 2012 10:51:35 -0500 Received: from mx1.redhat.com ([209.132.183.28]:37343) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RnBJo-0003kW-7K for qemu-devel@nongnu.org; Tue, 17 Jan 2012 10:51:28 -0500 Received: from int-mx10.intmail.prod.int.phx2.redhat.com (int-mx10.intmail.prod.int.phx2.redhat.com [10.5.11.23]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id q0HFpRGo032511 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Tue, 17 Jan 2012 10:51:27 -0500 From: Gerd Hoffmann Date: Tue, 17 Jan 2012 16:51:25 +0100 Message-Id: <1326815485-14428-2-git-send-email-kraxel@redhat.com> In-Reply-To: <1326815485-14428-1-git-send-email-kraxel@redhat.com> References: <1326815485-14428-1-git-send-email-kraxel@redhat.com> Subject: [Qemu-devel] [PATCH] qxl: Slot sanity check in qxl_phys2virt() is off by one, fix List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Markus Armbruster , Gerd Hoffmann From: Markus Armbruster Spotted by Coverity. Signed-off-by: Markus Armbruster Signed-off-by: Gerd Hoffmann --- hw/qxl.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/hw/qxl.c b/hw/qxl.c index ac81927..bdd36f9 100644 --- a/hw/qxl.c +++ b/hw/qxl.c @@ -1020,7 +1020,7 @@ void *qxl_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL pqxl, int group_id) case MEMSLOT_GROUP_HOST: return (void*)offset; case MEMSLOT_GROUP_GUEST: - PANIC_ON(slot > NUM_MEMSLOTS); + PANIC_ON(slot >= NUM_MEMSLOTS); PANIC_ON(!qxl->guest_slots[slot].active); PANIC_ON(offset < qxl->guest_slots[slot].delta); offset -= qxl->guest_slots[slot].delta; -- 1.7.1