From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:35292) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aLxtL-0000Xd-Fd for qemu-devel@nongnu.org; Wed, 20 Jan 2016 13:54:04 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1aLxtG-0007WQ-H0 for qemu-devel@nongnu.org; Wed, 20 Jan 2016 13:54:03 -0500 Received: from mx1.redhat.com ([209.132.183.28]:60297) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aLxtG-0007WM-Bh for qemu-devel@nongnu.org; Wed, 20 Jan 2016 13:53:58 -0500 Date: Thu, 21 Jan 2016 00:23:53 +0530 (IST) From: P J P In-Reply-To: Message-ID: References: <1453295640-28120-1-git-send-email-ppandit@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Subject: Re: [Qemu-devel] [PATCH] sd: limit sd_cmd_type array index 'req.cmd' List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Peter Maydell Cc: Qinghao Tang , QEMU Developers +-- On Wed, 20 Jan 2016, Peter Maydell wrote --+ | This isn't the only bit of sd.c that assumes that the controller | model hasn't passed it an oversize command number -- | sd_do_command() calls cmd_valid_while_locked() which uses req.cmd | as an index into sd_cmd_class[]. Ah yes; I looked for 'req.cmd', but missed 'req->cmd'. I've sent a revised patch v2. Thank you. -- - P J P 47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F