From patchwork Tue Jun 23 01:53:04 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Gonglei (Arei)" X-Patchwork-Id: 487460 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [IPv6:2001:4830:134:3::11]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 63D1A140082 for ; Tue, 23 Jun 2015 11:54:08 +1000 (AEST) Received: from localhost ([::1]:42834 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Z7DPa-0002ZM-CI for incoming@patchwork.ozlabs.org; Mon, 22 Jun 2015 21:54:06 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:60319) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Z7DP5-0001b9-SS for qemu-devel@nongnu.org; Mon, 22 Jun 2015 21:53:36 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1Z7DP4-00038C-VC for qemu-devel@nongnu.org; Mon, 22 Jun 2015 21:53:35 -0400 Received: from szxga01-in.huawei.com ([58.251.152.64]:28879) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Z7DP2-00033B-3k; Mon, 22 Jun 2015 21:53:32 -0400 Received: from 172.24.2.119 (EHLO szxeml432-hub.china.huawei.com) ([172.24.2.119]) by szxrg01-dlp.huawei.com (MOS 4.3.7-GA FastPath queued) with ESMTP id CPV49914; Tue, 23 Jun 2015 09:53:26 +0800 (CST) Received: from localhost (10.177.19.102) by szxeml432-hub.china.huawei.com (10.82.67.209) with Microsoft SMTP Server id 14.3.158.1; Tue, 23 Jun 2015 09:53:08 +0800 From: To: Date: Tue, 23 Jun 2015 09:53:04 +0800 Message-ID: <1435024385-9084-2-git-send-email-arei.gonglei@huawei.com> X-Mailer: git-send-email 1.7.3.1.msysgit.0 In-Reply-To: <1435024385-9084-1-git-send-email-arei.gonglei@huawei.com> References: <1435024385-9084-1-git-send-email-arei.gonglei@huawei.com> MIME-Version: 1.0 X-Originating-IP: [10.177.19.102] X-CFilter-Loop: Reflected X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.4.x-2.6.x [generic] X-Received-From: 58.251.152.64 Cc: qemu-trivial@nongnu.org, Gonglei , mst@redhat.com Subject: [Qemu-devel] [PATCH 1/2] virito-pci: fix OVERRUN problem X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org From: Gonglei Overrunning array "proxy->guest_features" of 2 4-byte elements at element index 2 (byte offset 8) using index "proxy->gfselect" (which evaluates to 2). Normally, the Linux kernel driver just read/write '0' or '1' as the "proxy->gfselect" values, so using '<' instead of '=<' to make coverity happy and avoid potential harm. Cc: Michael S. Tsirkin Signed-off-by: Gonglei --- hw/virtio/virtio-pci.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c index d7cf34c..ce1c46e 100644 --- a/hw/virtio/virtio-pci.c +++ b/hw/virtio/virtio-pci.c @@ -977,7 +977,7 @@ static uint64_t virtio_pci_common_read(void *opaque, hwaddr addr, val = proxy->gfselect; break; case VIRTIO_PCI_COMMON_GF: - if (proxy->gfselect <= ARRAY_SIZE(proxy->guest_features)) { + if (proxy->gfselect < ARRAY_SIZE(proxy->guest_features)) { val = proxy->guest_features[proxy->gfselect]; } break; @@ -1052,7 +1052,7 @@ static void virtio_pci_common_write(void *opaque, hwaddr addr, proxy->gfselect = val; break; case VIRTIO_PCI_COMMON_GF: - if (proxy->gfselect <= ARRAY_SIZE(proxy->guest_features)) { + if (proxy->gfselect < ARRAY_SIZE(proxy->guest_features)) { proxy->guest_features[proxy->gfselect] = val; virtio_set_features(vdev, (((uint64_t)proxy->guest_features[1]) << 32) |