From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:39854) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1UjXXj-0001FV-Bn for qemu-devel@nongnu.org; Mon, 03 Jun 2013 12:23:36 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1UjXXh-0004PT-R3 for qemu-devel@nongnu.org; Mon, 03 Jun 2013 12:23:35 -0400 Received: from mx1.redhat.com ([209.132.183.28]:58786) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1UjXXh-0004PI-Jt for qemu-devel@nongnu.org; Mon, 03 Jun 2013 12:23:33 -0400 From: Igor Mammedov Date: Mon, 3 Jun 2013 18:23:27 +0200 Message-Id: <1370276607-4180-1-git-send-email-imammedo@redhat.com> Subject: [Qemu-devel] [PATCH] target-i386: cpu: fix potential buffer overrun in get_register_name_32() List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: afaerber@suse.de spotted by Coverity, x86_reg_info_32[] is CPU_NB_REGS32 elements long, so accessing x86_reg_info_32[CPU_NB_REGS32] will be one element off array. Signed-off-by: Igor Mammedov --- target-i386/cpu.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/target-i386/cpu.c b/target-i386/cpu.c index 1a501d9..ae8e682 100644 --- a/target-i386/cpu.c +++ b/target-i386/cpu.c @@ -221,7 +221,7 @@ X86RegisterInfo32 x86_reg_info_32[CPU_NB_REGS32] = { const char *get_register_name_32(unsigned int reg) { - if (reg > CPU_NB_REGS32) { + if (reg >= CPU_NB_REGS32) { return NULL; } return x86_reg_info_32[reg].name; -- 1.7.1