[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [Qemu-devel PATCH v3 1/2] sd: Fix out-of-bounds assertions
From: |
Lidong Chen |
Subject: |
[Qemu-devel] [Qemu-devel PATCH v3 1/2] sd: Fix out-of-bounds assertions |
Date: |
Wed, 19 Jun 2019 15:14:46 -0400 |
Due to an off-by-one error, the assert statements allow an
out-of-bound array access.
Signed-off-by: Lidong Chen <address@hidden>
Reviewed-by: Liam Merwick <address@hidden>
Reviewed-by: Marc-André Lureau <address@hidden>
Reviewed-by: Philippe Mathieu-Daudé <address@hidden>
Reviewed-by: Li Qiang <address@hidden>
Reviewed-by: Darren Kenny <address@hidden>
---
hw/sd/sd.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index aaab15f..818f86c 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -144,7 +144,7 @@ static const char *sd_state_name(enum SDCardStates state)
if (state == sd_inactive_state) {
return "inactive";
}
- assert(state <= ARRAY_SIZE(state_name));
+ assert(state < ARRAY_SIZE(state_name));
return state_name[state];
}
@@ -165,7 +165,7 @@ static const char *sd_response_name(sd_rsp_type_t rsp)
if (rsp == sd_r1b) {
rsp = sd_r1;
}
- assert(rsp <= ARRAY_SIZE(response_name));
+ assert(rsp < ARRAY_SIZE(response_name));
return response_name[rsp];
}
--
1.8.3.1