From 1c598ab2b88571d8c75cfebbef09d4c1c675132c Mon Sep 17 00:00:00 2001 From: Lidong Chen Date: Wed, 19 Jun 2019 15:14:46 -0400 Subject: sd: Fix out-of-bounds assertions Due to an off-by-one error, the assert statements allow an out-of-bound array access. This doesn't happen in practice, but the static analyzer notices. Signed-off-by: Lidong Chen Reviewed-by: Liam Merwick Reviewed-by: Marc-André Lureau Reviewed-by: Philippe Mathieu-Daudé Reviewed-by: Li Qiang Reviewed-by: Darren Kenny Message-Id: <6b19cb7359a10a6bedc3ea0fce22fed3ef93c102.1560806687.git.lidong.chen@oracle.com> Signed-off-by: Paolo Bonzini --- hw/sd/sd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'hw/sd/sd.c') diff --git a/hw/sd/sd.c b/hw/sd/sd.c index 60500ec8fe..917195a65b 100644 --- a/hw/sd/sd.c +++ b/hw/sd/sd.c @@ -145,7 +145,7 @@ static const char *sd_state_name(enum SDCardStates state) if (state == sd_inactive_state) { return "inactive"; } - assert(state <= ARRAY_SIZE(state_name)); + assert(state < ARRAY_SIZE(state_name)); return state_name[state]; } @@ -166,7 +166,7 @@ static const char *sd_response_name(sd_rsp_type_t rsp) if (rsp == sd_r1b) { rsp = sd_r1; } - assert(rsp <= ARRAY_SIZE(response_name)); + assert(rsp < ARRAY_SIZE(response_name)); return response_name[rsp]; } -- cgit v1.2.3-55-g7522