Re: [PATCH 1/2] migration: Assert that migrate_multifd_compression() returns an in-range value

From: Juan Quintela <quintela@redhat.com>
To: Peter Maydell <peter.maydell@linaro.org>
Cc: qemu-devel@nongnu.org,  qemu-block@nongnu.org,
	 "Dr. David Alan Gilbert" <dgilbert@redhat.com>,
	 Fam Zheng <fam@euphon.net>,
	 Stefan Hajnoczi <stefanha@redhat.com>
Subject: Re: [PATCH 1/2] migration: Assert that migrate_multifd_compression() returns an in-range value
Date: Fri, 22 Jul 2022 13:00:12 +0200	[thread overview]
Message-ID: <87pmhx5s5f.fsf@secure.mitica> (raw)
In-Reply-To: <20220721115207.729615-2-peter.maydell@linaro.org> (Peter Maydell's message of "Thu, 21 Jul 2022 12:52:06 +0100")

Peter Maydell <peter.maydell@linaro.org> wrote:
> Coverity complains that when we use the return value from
> migrate_multifd_compression() as an array index:
>   multifd_recv_state->ops = multifd_ops[migrate_multifd_compression()];
>
> that this might overrun the array (which is declared to have size
> MULTIFD_COMPRESSION__MAX).  This is because the function return type
> is MultiFDCompression, which is an autogenerated enum.  The code
> generator includes the "one greater than the maximum possible value"
> MULTIFD_COMPRESSION__MAX in the enum, even though this is not
> actually a valid value for the enum, and this makes Coverity think
> that migrate_multifd_compression() could return that __MAX value and
> index off the end of the array.
>
> Suppress the Coverity error by asserting that the value we're going
> to return is within range.
>
> Resolves: Coverity CID 1487239, 1487254
> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Juan Quintela <quintela@redhat.com>