On Tue, 4 Jul 2023 at 16:13, Woodhouse, David <d...@amazon.co.uk> wrote:
>
> Coverity points out (CID 1508128) a bounds checking error. We need to check
> for gsi >= IOAPIC_NUM_PINS, not just greater-than.
>
> Also fix up an assert() that has the same problem, that Coverity didn't see.
>
> Signed-off-by: David Woodhouse <d...@amazon.co.uk>
> ---
> hw/i386/kvm/xen_evtchn.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/hw/i386/kvm/xen_evtchn.c b/hw/i386/kvm/xen_evtchn.c
> index 3d810dbd59..0e9c108614 100644
> --- a/hw/i386/kvm/xen_evtchn.c
> +++ b/hw/i386/kvm/xen_evtchn.c
> @@ -1587,7 +1587,7 @@ static int allocate_pirq(XenEvtchnState *s, int type,
> int gsi)
> found:
> pirq_inuse_word(s, pirq) |= pirq_inuse_bit(pirq);
> if (gsi >= 0) {
> - assert(gsi <= IOAPIC_NUM_PINS);
> + assert(gsi < IOAPIC_NUM_PINS);
> s->gsi_pirq[gsi] = pirq;
> }
> s->pirq[pirq].gsi = gsi;
> @@ -1601,7 +1601,7 @@ bool xen_evtchn_set_gsi(int gsi, int level)
>
> assert(qemu_mutex_iothread_locked());
>
> - if (!s || gsi < 0 || gsi > IOAPIC_NUM_PINS) {
> + if (!s || gsi < 0 || gsi >= IOAPIC_NUM_PINS) {
> return false;
> }
Reviewed-by: Peter Maydell <peter.mayd...@linaro.org>
thanks
-- PMM
