[Top][All Lists]
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH] qxl: Slot sanity check in qxl_phys2virt() is of
From: |
Alon Levy |
Subject: |
Re: [Qemu-devel] [PATCH] qxl: Slot sanity check in qxl_phys2virt() is off by one, fix |
Date: |
Tue, 17 Jan 2012 13:57:41 +0200 |
User-agent: |
Mutt/1.5.21 (2010-09-15) |
On Tue, Jan 17, 2012 at 10:08:47AM +0100, Markus Armbruster wrote:
> Ping?
>
> Markus Armbruster <address@hidden> writes:
>
Reviewed-by: Alon Levy <address@hidden>
> > Spotted by Coverity.
> >
> > Signed-off-by: Markus Armbruster <address@hidden>
> > ---
> > hw/qxl.c | 2 +-
> > 1 files changed, 1 insertions(+), 1 deletions(-)
> >
> > diff --git a/hw/qxl.c b/hw/qxl.c
> > index 84ffd45..c97bebe 100644
> > --- a/hw/qxl.c
> > +++ b/hw/qxl.c
> > @@ -1006,7 +1006,7 @@ void *qxl_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL
> > pqxl, int group_id)
> > case MEMSLOT_GROUP_HOST:
> > return (void*)offset;
> > case MEMSLOT_GROUP_GUEST:
> > - PANIC_ON(slot > NUM_MEMSLOTS);
> > + PANIC_ON(slot >= NUM_MEMSLOTS);
> > PANIC_ON(!qxl->guest_slots[slot].active);
> > PANIC_ON(offset < qxl->guest_slots[slot].delta);
> > offset -= qxl->guest_slots[slot].delta;
>