qxl: Slot sanity check in qxl_phys2virt() is off by one, fix
Spotted by Coverity. Signed-off-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
This commit is contained in:
parent
515aa3c579
commit
6b7332eb40
2
hw/qxl.c
2
hw/qxl.c
|
@ -1020,7 +1020,7 @@ void *qxl_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL pqxl, int group_id)
|
|||
case MEMSLOT_GROUP_HOST:
|
||||
return (void*)offset;
|
||||
case MEMSLOT_GROUP_GUEST:
|
||||
PANIC_ON(slot > NUM_MEMSLOTS);
|
||||
PANIC_ON(slot >= NUM_MEMSLOTS);
|
||||
PANIC_ON(!qxl->guest_slots[slot].active);
|
||||
PANIC_ON(offset < qxl->guest_slots[slot].delta);
|
||||
offset -= qxl->guest_slots[slot].delta;
|
||||
|
|
Loading…
Reference in a new issue