[Top][All Lists]
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH 1/2] qxl: Fix SPICE_RING_PROD_ITEM(), SPICE_RING_CON
From: |
Markus Armbruster |
Subject: |
[Qemu-devel] [PATCH 1/2] qxl: Fix SPICE_RING_PROD_ITEM(), SPICE_RING_CONS_ITEM() sanity check |
Date: |
Thu, 10 Jan 2013 14:24:49 +0100 |
From: Markus Armbruster <address@hidden>
The pointer arithmetic there is safe, but ugly. Coverity grouses
about it. However, the actual comparison is off by one: <= end
instead of < end. Fix by rewriting the check in a cleaner way.
Signed-off-by: Markus Armbruster <address@hidden>
---
hw/qxl.c | 20 ++++++--------------
1 file changed, 6 insertions(+), 14 deletions(-)
diff --git a/hw/qxl.c b/hw/qxl.c
index d08b9bd..2c2b422 100644
--- a/hw/qxl.c
+++ b/hw/qxl.c
@@ -37,33 +37,25 @@
*/
#undef SPICE_RING_PROD_ITEM
#define SPICE_RING_PROD_ITEM(qxl, r, ret) { \
- typeof(r) start = r; \
- typeof(r) end = r + 1; \
uint32_t prod = (r)->prod & SPICE_RING_INDEX_MASK(r); \
- typeof(&(r)->items[prod]) m_item = &(r)->items[prod]; \
- if (!((uint8_t*)m_item >= (uint8_t*)(start) && (uint8_t*)(m_item + 1)
<= (uint8_t*)(end))) { \
+ if (prod >= ARRAY_SIZE((r)->items)) { \
qxl_set_guest_bug(qxl, "SPICE_RING_PROD_ITEM indices mismatch " \
- "! %p <= %p < %p", (uint8_t *)start, \
- (uint8_t *)m_item, (uint8_t *)end); \
+ "%u >= %zu", prod, ARRAY_SIZE((r)->items)); \
ret = NULL; \
} else { \
- ret = &m_item->el; \
+ ret = &(r)->items[prod].el; \
} \
}
#undef SPICE_RING_CONS_ITEM
#define SPICE_RING_CONS_ITEM(qxl, r, ret) { \
- typeof(r) start = r; \
- typeof(r) end = r + 1; \
uint32_t cons = (r)->cons & SPICE_RING_INDEX_MASK(r); \
- typeof(&(r)->items[cons]) m_item = &(r)->items[cons]; \
- if (!((uint8_t*)m_item >= (uint8_t*)(start) && (uint8_t*)(m_item + 1)
<= (uint8_t*)(end))) { \
+ if (cons >= ARRAY_SIZE((r)->items)) { \
qxl_set_guest_bug(qxl, "SPICE_RING_CONS_ITEM indices mismatch " \
- "! %p <= %p < %p", (uint8_t *)start, \
- (uint8_t *)m_item, (uint8_t *)end); \
+ "%u >= %zu", cons, ARRAY_SIZE((r)->items)); \
ret = NULL; \
} else { \
- ret = &m_item->el; \
+ ret = &(r)->items[cons].el; \
} \
}
--
1.7.11.7