Message ID | 20220331122652.188700-1-berrange@redhat.com |
---|---|
State | New |
Headers | show |
Series | hw/char: fix qcode array bounds check in ESCC impl | expand |
On Thu, 31 Mar 2022 at 13:27, Daniel P. Berrangé <berrange@redhat.com> wrote: > > There was an off-by-1 in the qcode conversion array bounds > check. > > Fixes: e709a61a8fe1076a487376fd657544418a38ba06 > Reported-by: Peter Maydell <peter.maydell@linaro.org> > Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> > --- > hw/char/escc.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/hw/char/escc.c b/hw/char/escc.c > index 8755d8d34f..17a908c59b 100644 > --- a/hw/char/escc.c > +++ b/hw/char/escc.c > @@ -828,7 +828,7 @@ static void sunkbd_handle_event(DeviceState *dev, QemuConsole *src, > } > } > > - if (qcode > qemu_input_map_qcode_to_sun_len) { > + if (qcode >= qemu_input_map_qcode_to_sun_len) { > return; > } Reviewed-by: Peter Maydell <peter.maydell@linaro.org> thanks -- PMM
diff --git a/hw/char/escc.c b/hw/char/escc.c index 8755d8d34f..17a908c59b 100644 --- a/hw/char/escc.c +++ b/hw/char/escc.c @@ -828,7 +828,7 @@ static void sunkbd_handle_event(DeviceState *dev, QemuConsole *src, } } - if (qcode > qemu_input_map_qcode_to_sun_len) { + if (qcode >= qemu_input_map_qcode_to_sun_len) { return; }
There was an off-by-1 in the qcode conversion array bounds check. Fixes: e709a61a8fe1076a487376fd657544418a38ba06 Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> --- hw/char/escc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)