From 8858b6d0dac346d9f841cfa84f57cb03bffdf050 Mon Sep 17 00:00:00 2001

From: Markus Armbruster <armbru@redhat.com>

Date: Fri, 4 Nov 2011 10:34:24 +0100

Subject: [PATCH 401/434] qxl: Slot sanity check in qxl_phys2virt() is off by

 one, fix

Spotted by Coverity.

Signed-off-by: Markus Armbruster <armbru@redhat.com>

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

---

 hw/qxl.c |    2 +-

 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/qxl.c b/hw/qxl.c

index 41500e9..e0f9d4a 100644

--- a/hw/qxl.c

+++ b/hw/qxl.c

@@ -1020,7 +1020,7 @@ void *qxl_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL pqxl, int group_id)

     case MEMSLOT_GROUP_HOST:

         return (void*)offset;

     case MEMSLOT_GROUP_GUEST:

-        PANIC_ON(slot > NUM_MEMSLOTS);

+        PANIC_ON(slot >= NUM_MEMSLOTS);

         PANIC_ON(!qxl->guest_slots[slot].active);

         PANIC_ON(offset < qxl->guest_slots[slot].delta);

         offset -= qxl->guest_slots[slot].delta;

-- 

1.7.10