From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:60306) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Z8Twy-0005os-J2 for qemu-devel@nongnu.org; Fri, 26 Jun 2015 09:45:49 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1Z8Twv-0001GX-BD for qemu-devel@nongnu.org; Fri, 26 Jun 2015 09:45:48 -0400 Received: from mx1.redhat.com ([209.132.183.28]:32952) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Z8Twv-0001GP-6l for qemu-devel@nongnu.org; Fri, 26 Jun 2015 09:45:45 -0400 Date: Fri, 26 Jun 2015 15:45:42 +0200 From: "Michael S. Tsirkin" Message-ID: <1435326248-24291-2-git-send-email-mst@redhat.com> References: <1435326248-24291-1-git-send-email-mst@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1435326248-24291-1-git-send-email-mst@redhat.com> Subject: [Qemu-devel] [PULL 01/17] virito-pci: fix OVERRUN problem List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Peter Maydell , Gonglei From: Gonglei Overrunning array "proxy->guest_features" of 2 4-byte elements at element index 2 (byte offset 8) using index "proxy->gfselect" (which evaluates to 2). Normally, the Linux kernel driver just read/write '0' or '1' as the "proxy->gfselect" values, so using '<' instead of '=<' to make coverity happy and avoid potential harm. Cc: Michael S. Tsirkin Signed-off-by: Gonglei Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin --- hw/virtio/virtio-pci.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c index d7cf34c..ce1c46e 100644 --- a/hw/virtio/virtio-pci.c +++ b/hw/virtio/virtio-pci.c @@ -977,7 +977,7 @@ static uint64_t virtio_pci_common_read(void *opaque, hwaddr addr, val = proxy->gfselect; break; case VIRTIO_PCI_COMMON_GF: - if (proxy->gfselect <= ARRAY_SIZE(proxy->guest_features)) { + if (proxy->gfselect < ARRAY_SIZE(proxy->guest_features)) { val = proxy->guest_features[proxy->gfselect]; } break; @@ -1052,7 +1052,7 @@ static void virtio_pci_common_write(void *opaque, hwaddr addr, proxy->gfselect = val; break; case VIRTIO_PCI_COMMON_GF: - if (proxy->gfselect <= ARRAY_SIZE(proxy->guest_features)) { + if (proxy->gfselect < ARRAY_SIZE(proxy->guest_features)) { proxy->guest_features[proxy->gfselect] = val; virtio_set_features(vdev, (((uint64_t)proxy->guest_features[1]) << 32) | -- MST