31 lines
965 B
Diff
31 lines
965 B
Diff
From 8858b6d0dac346d9f841cfa84f57cb03bffdf050 Mon Sep 17 00:00:00 2001
|
|
From: Markus Armbruster <armbru@redhat.com>
|
|
Date: Fri, 4 Nov 2011 10:34:24 +0100
|
|
Subject: [PATCH 401/434] qxl: Slot sanity check in qxl_phys2virt() is off by
|
|
one, fix
|
|
|
|
Spotted by Coverity.
|
|
|
|
Signed-off-by: Markus Armbruster <armbru@redhat.com>
|
|
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
|
|
---
|
|
hw/qxl.c | 2 +-
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
|
diff --git a/hw/qxl.c b/hw/qxl.c
|
|
index 41500e9..e0f9d4a 100644
|
|
--- a/hw/qxl.c
|
|
+++ b/hw/qxl.c
|
|
@@ -1020,7 +1020,7 @@ void *qxl_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL pqxl, int group_id)
|
|
case MEMSLOT_GROUP_HOST:
|
|
return (void*)offset;
|
|
case MEMSLOT_GROUP_GUEST:
|
|
- PANIC_ON(slot > NUM_MEMSLOTS);
|
|
+ PANIC_ON(slot >= NUM_MEMSLOTS);
|
|
PANIC_ON(!qxl->guest_slots[slot].active);
|
|
PANIC_ON(offset < qxl->guest_slots[slot].delta);
|
|
offset -= qxl->guest_slots[slot].delta;
|
|
--
|
|
1.7.10
|
|
|