Patchwork qxl: Slot sanity check in qxl_phys2virt() is off by one, fix

login
register
mail settings
Submitter Gerd Hoffmann
Date Jan. 17, 2012, 3:51 p.m.
Message ID <1326815485-14428-2-git-send-email-kraxel@redhat.com>
Download mbox | patch
Permalink /patch/136496/
State New
Headers show

Comments

Gerd Hoffmann - Jan. 17, 2012, 3:51 p.m.
From: Markus Armbruster <armbru@redhat.com>

Spotted by Coverity.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
 hw/qxl.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

Patch

diff --git a/hw/qxl.c b/hw/qxl.c
index ac81927..bdd36f9 100644
--- a/hw/qxl.c
+++ b/hw/qxl.c
@@ -1020,7 +1020,7 @@  void *qxl_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL pqxl, int group_id)
     case MEMSLOT_GROUP_HOST:
         return (void*)offset;
     case MEMSLOT_GROUP_GUEST:
-        PANIC_ON(slot > NUM_MEMSLOTS);
+        PANIC_ON(slot >= NUM_MEMSLOTS);
         PANIC_ON(!qxl->guest_slots[slot].active);
         PANIC_ON(offset < qxl->guest_slots[slot].delta);
         offset -= qxl->guest_slots[slot].delta;