From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:43134) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XMk8t-0005NM-KH for qemu-devel@nongnu.org; Wed, 27 Aug 2014 16:48:38 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1XMk8k-0003J3-GN for qemu-devel@nongnu.org; Wed, 27 Aug 2014 16:48:31 -0400 Received: from e7.ny.us.ibm.com ([32.97.182.137]:58312) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XMk8j-0003Ic-Vp for qemu-devel@nongnu.org; Wed, 27 Aug 2014 16:48:22 -0400 Received: from /spool/local by e7.ny.us.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Wed, 27 Aug 2014 13:39:55 -0400 From: Michael Roth Date: Wed, 27 Aug 2014 12:36:19 -0500 Message-Id: <1409160982-16389-23-git-send-email-mdroth@linux.vnet.ibm.com> In-Reply-To: <1409160982-16389-1-git-send-email-mdroth@linux.vnet.ibm.com> References: <1409160982-16389-1-git-send-email-mdroth@linux.vnet.ibm.com> Subject: [Qemu-devel] [PATCH 22/25] pcihp: fix possible array out of bounds List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org From: Gonglei Prevent out-of-bounds array access on acpi_pcihp_pci_status. Signed-off-by: Gonglei Reviewed-by: Peter Crosthwaite Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin Cc: qemu-stable@nongnu.org Reviewed-by: Marcel Apfelbaum (cherry picked from commit fa365d7cd11185237471823a5a33d36765454e16) Signed-off-by: Michael Roth --- hw/acpi/pcihp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/acpi/pcihp.c b/hw/acpi/pcihp.c index fae663a..34dedf1 100644 --- a/hw/acpi/pcihp.c +++ b/hw/acpi/pcihp.c @@ -231,7 +231,7 @@ static uint64_t pci_read(void *opaque, hwaddr addr, unsigned int size) uint32_t val = 0; int bsel = s->hotplug_select; - if (bsel < 0 || bsel > ACPI_PCIHP_MAX_HOTPLUG_BUS) { + if (bsel < 0 || bsel >= ACPI_PCIHP_MAX_HOTPLUG_BUS) { return 0; } -- 1.9.1