qemu-devel.nongnu.org archive mirror
 help / color / mirror / Atom feed
From: "Philippe Mathieu-Daudé" <philmd@redhat.com>
To: Lidong Chen <lidong.chen@oracle.com>, qemu-devel@nongnu.org
Cc: darren.kenny@oracle.com, f4bug@amsat.org
Subject: Re: [Qemu-devel] [PATCH] sd: Fix out-of-bounds assertions
Date: Mon, 8 Apr 2019 23:27:07 +0200	[thread overview]
Message-ID: <d35048f6-44e7-46a0-3d70-51123896f1ef@redhat.com> (raw)
In-Reply-To: <1554750276-19230-1-git-send-email-lidong.chen@oracle.com>

Hi Lidong

On 4/8/19 9:04 PM, Lidong Chen wrote:
> Due to an off-by-one error, the assert statements allow an
> out-of-bounds array access.

... which can't happen. Thus harmless for 4.0.

I suppose this is a static analysis warning and you didn't triggered it
while tracing.

Thanks for cleaning this :)

Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>

> Signed-off-by: Lidong Chen <lidong.chen@oracle.com>
> ---
>  hw/sd/sd.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/hw/sd/sd.c b/hw/sd/sd.c
> index aaab15f..818f86c 100644
> --- a/hw/sd/sd.c
> +++ b/hw/sd/sd.c
> @@ -144,7 +144,7 @@ static const char *sd_state_name(enum SDCardStates state)
>      if (state == sd_inactive_state) {
>          return "inactive";
>      }
> -    assert(state <= ARRAY_SIZE(state_name));
> +    assert(state < ARRAY_SIZE(state_name));
>      return state_name[state];
>  }
>  
> @@ -165,7 +165,7 @@ static const char *sd_response_name(sd_rsp_type_t rsp)
>      if (rsp == sd_r1b) {
>          rsp = sd_r1;
>      }
> -    assert(rsp <= ARRAY_SIZE(response_name));
> +    assert(rsp < ARRAY_SIZE(response_name));
>      return response_name[rsp];
>  }
>  
> 

  parent reply	other threads:[~2019-04-08 21:27 UTC|newest]

Thread overview: 32+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-04-08 19:04 [Qemu-devel] [PATCH] sd: Fix out-of-bounds assertions Lidong Chen
2019-04-08 19:04 ` Lidong Chen
2019-04-08 19:53 ` Marc-André Lureau
2019-04-08 19:53   ` Marc-André Lureau
2019-04-08 21:27 ` Philippe Mathieu-Daudé [this message]
2019-04-08 21:27   ` Philippe Mathieu-Daudé
2019-04-08 21:57   ` Lidong Chen
2019-04-08 21:57     ` Lidong Chen
2019-04-09  0:18 ` Li Qiang
2019-04-09  0:18   ` Li Qiang
2019-04-09  5:51 ` Markus Armbruster
2019-04-09  5:51   ` Markus Armbruster
2019-04-09  8:59   ` Aleksandar Markovic
2019-04-09  8:59     ` Aleksandar Markovic
2019-04-09  9:37     ` Philippe Mathieu-Daudé
2019-04-09  9:37       ` Philippe Mathieu-Daudé
2019-04-11 11:52       ` Daniel P. Berrangé
2019-04-11 11:52         ` Daniel P. Berrangé
2019-04-11 12:20         ` Markus Armbruster
2019-04-11 12:20           ` Markus Armbruster
2019-04-11 12:45           ` Daniel P. Berrangé
2019-04-11 12:45             ` Daniel P. Berrangé
2019-04-11 13:25             ` Markus Armbruster
2019-04-11 13:25               ` Markus Armbruster
2019-04-09  9:40   ` Aleksandar Markovic
2019-04-09  9:40     ` Aleksandar Markovic
2019-04-09  9:48   ` Peter Maydell
2019-04-09  9:48     ` Peter Maydell
2019-04-09 10:39   ` Liam Merwick
2019-04-09 10:39     ` Liam Merwick
2019-04-10 21:49     ` Lidong Chen
2019-04-10 21:49       ` Lidong Chen

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=d35048f6-44e7-46a0-3d70-51123896f1ef@redhat.com \
    --to=philmd@redhat.com \
    --cc=darren.kenny@oracle.com \
    --cc=f4bug@amsat.org \
    --cc=lidong.chen@oracle.com \
    --cc=qemu-devel@nongnu.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).