Re: [Qemu-ppc] [PATCH] pseries: Fix array overrun bug in PCI code

[Alexander Graf]

On 29.11.2011, at 07:21, David Gibson wrote:

> spapr_populate_pci_devices() containd a loop with PCI_NUM_REGIONS (7)
> iterations.  However this overruns the 'bars' global array, which only has
> 6 elements. In fact we only want to run this loop for things listed in the
> bars array, so this patch corrects the loop bounds to reflect that.
> 
> Signed-off-by: David Gibson <address@hidden>

Thanks, applied to ppc-next and queued for 1.0.

Alex

> ---
> hw/spapr_pci.c |    2 +-
> 1 files changed, 1 insertions(+), 1 deletions(-)
> 
> diff --git a/hw/spapr_pci.c b/hw/spapr_pci.c
> index 7162588..9b6a032 100644
> --- a/hw/spapr_pci.c
> +++ b/hw/spapr_pci.c
> @@ -454,7 +454,7 @@ int spapr_populate_pci_devices(sPAPRPHBState *phb,
>         reg[0].size = 0;
> 
>         n = 0;
> -        for (i = 0; i < PCI_NUM_REGIONS; ++i) {
> +        for (i = 0; i < ARRAY_SIZE(bars); ++i) {
>             if (0 == dev->io_regions[i].size) {
>                 continue;
>             }
> -- 
> 1.7.7.3
>