diff options
| author | Gleb Natapov | 2010-11-09 08:36:53 +0100 |
|---|---|---|
| committer | Anthony Liguori | 2010-11-16 21:35:00 +0100 |
| commit | d59f8ba938afd837182e666cce777dfb860559e4 (patch) | |
| tree | 7d31de4a9f7da1d44506fd6327503ad360c0707d /hw/usb-net.c | |
| parent | Merge remote branch 'spice/bugfix.2' into staging (diff) | |
| download | qemu-d59f8ba938afd837182e666cce777dfb860559e4.tar.gz qemu-d59f8ba938afd837182e666cce777dfb860559e4.tar.xz qemu-d59f8ba938afd837182e666cce777dfb860559e4.zip | |
Out off array access in usb-net
Properly check array bounds before accessing array element.
Signed-off-by: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Diffstat (limited to 'hw/usb-net.c')
| -rw-r--r-- | hw/usb-net.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/hw/usb-net.c b/hw/usb-net.c index 70f9263291..58c672f426 100644 --- a/hw/usb-net.c +++ b/hw/usb-net.c @@ -1142,7 +1142,7 @@ static int usb_net_handle_control(USBDevice *dev, int request, int value, break; default: - if (usb_net_stringtable[value & 0xff]) { + if (ARRAY_SIZE(usb_net_stringtable) > (value & 0xff)) { ret = set_usb_string(data, usb_net_stringtable[value & 0xff]); break; |