On 06/02/2016 20:13, Michael S. Tsirkin wrote: > > - if (sdr[7] > MAX_SENSORS) { > + if (sdr->sensor_owner_number > MAX_SENSORS) {
This is another off-by-one, it should have been >=. Same for all these occurrences later in the same file: hw/ipmi/ipmi_bmc_sim.c: if ((cmd[2] > MAX_SENSORS) || hw/ipmi/ipmi_bmc_sim.c: if ((cmd[2] > MAX_SENSORS) || hw/ipmi/ipmi_bmc_sim.c: if ((cmd[2] > MAX_SENSORS) || hw/ipmi/ipmi_bmc_sim.c: if ((cmd[2] > MAX_SENSORS) || hw/ipmi/ipmi_bmc_sim.c: if ((cmd[2] > MAX_SENSORS) || hw/ipmi/ipmi_bmc_sim.c: if ((cmd[2] > MAX_SENSORS) || hw/ipmi/ipmi_bmc_sim.c: if ((cmd[2] > MAX_SENSORS) || Thanks, Paolo > continue; > }