Re: [Qemu-devel] [PATCH] qxl: Slot sanity check in qxl_phys2virt() is off by one, fix

[Markus Armbruster]

Ping?

Markus Armbruster <address@hidden> writes:

> Spotted by Coverity.
>
> Signed-off-by: Markus Armbruster <address@hidden>
> ---
>  hw/qxl.c |    2 +-
>  1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/hw/qxl.c b/hw/qxl.c
> index 84ffd45..c97bebe 100644
> --- a/hw/qxl.c
> +++ b/hw/qxl.c
> @@ -1006,7 +1006,7 @@ void *qxl_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL 
> pqxl, int group_id)
>      case MEMSLOT_GROUP_HOST:
>          return (void*)offset;
>      case MEMSLOT_GROUP_GUEST:
> -        PANIC_ON(slot > NUM_MEMSLOTS);
> +        PANIC_ON(slot >= NUM_MEMSLOTS);
>          PANIC_ON(!qxl->guest_slots[slot].active);
>          PANIC_ON(offset < qxl->guest_slots[slot].delta);
>          offset -= qxl->guest_slots[slot].delta;