From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:44772) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aEWEU-0002vY-Bk for qemu-devel@nongnu.org; Thu, 31 Dec 2015 00:57:07 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1aEWEQ-0008BH-CI for qemu-devel@nongnu.org; Thu, 31 Dec 2015 00:57:06 -0500 Received: from mx1.redhat.com ([209.132.183.28]:44690) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aEWEQ-0008BC-6b for qemu-devel@nongnu.org; Thu, 31 Dec 2015 00:57:02 -0500 Date: Thu, 31 Dec 2015 11:26:51 +0530 (IST) From: P J P In-Reply-To: <5684BB0A.3080007@redhat.com> Message-ID: References: <1451537606-16030-1-git-send-email-ppandit@redhat.com> <5684BB0A.3080007@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Subject: Re: [Qemu-devel] [PATVH v2] net: ne2000: fix bounds check in ioport operations List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Jason Wang Cc: Ling Liu , Prasad J Pandit , QEMU Developers +-- On Thu, 31 Dec 2015, Jason Wang wrote --+ | > - (addr >= NE2000_PMEM_START && addr < NE2000_MEM_SIZE)) { | > + if (addr < 32 || (addr >= NE2000_PMEM_START && addr < NE2000_MEM_SIZE)) { | | The change is unnecessary. Okay. | > + if (addr < 32 | > + || (addr >= NE2000_PMEM_START | > + && addr + sizeof(uint16_t) < NE2000_MEM_SIZE)) { | | I think you mean '<=' instead of '<' here? (And for the other checks below). I think <= would lead to an off-by-one, no? As the last array index would be one less than the size; Same as ne2000_mem_readb() above. Thank you. -- Prasad J Pandit / Red Hat Product Security Team 47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F