diff options
| author | Gonglei | 2015-02-10 08:51:22 +0100 |
|---|---|---|
| committer | Michael Tokarev | 2015-03-10 06:15:33 +0100 |
| commit | d4cd45028898a37afb45fb449954115b4960d4e9 (patch) | |
| tree | 879eaec793d6dba41194bb07c5e99eb74f30f9e1 | |
| parent | Merge remote-tracking branch 'remotes/agraf/tags/signed-ppc-for-upstream' int... (diff) | |
| download | qemu-d4cd45028898a37afb45fb449954115b4960d4e9.tar.gz qemu-d4cd45028898a37afb45fb449954115b4960d4e9.tar.xz qemu-d4cd45028898a37afb45fb449954115b4960d4e9.zip | |
xen-pt: fix Negative array index read
Coverity spot:
Function xen_pt_bar_offset_to_index() may return a negative
value (-1) which is used as an index to d->io_regions[] down
the line.
Let's pass index directly as an argument to
xen_pt_bar_reg_parse().
Signed-off-by: Gonglei <arei.gonglei@huawei.com>
Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
| -rw-r--r-- | hw/xen/xen_pt_config_init.c | 6 |
1 files changed, 2 insertions, 4 deletions
diff --git a/hw/xen/xen_pt_config_init.c b/hw/xen/xen_pt_config_init.c index de9a20f437..710fe501bc 100644 --- a/hw/xen/xen_pt_config_init.c +++ b/hw/xen/xen_pt_config_init.c @@ -360,15 +360,13 @@ static uint64_t xen_pt_get_bar_size(PCIIORegion *r) } static XenPTBarFlag xen_pt_bar_reg_parse(XenPCIPassthroughState *s, - XenPTRegInfo *reg) + int index) { PCIDevice *d = &s->dev; XenPTRegion *region = NULL; PCIIORegion *r; - int index = 0; /* check 64bit BAR */ - index = xen_pt_bar_offset_to_index(reg->offset); if ((0 < index) && (index < PCI_ROM_SLOT)) { int type = s->real_device.io_regions[index - 1].type; @@ -422,7 +420,7 @@ static int xen_pt_bar_reg_init(XenPCIPassthroughState *s, XenPTRegInfo *reg, } /* set BAR flag */ - s->bases[index].bar_flag = xen_pt_bar_reg_parse(s, reg); + s->bases[index].bar_flag = xen_pt_bar_reg_parse(s, index); if (s->bases[index].bar_flag == XEN_PT_BAR_FLAG_UNUSED) { reg_field = XEN_PT_INVALID_REG; } |