[Xen-changelog] [qemu-upstream-unstable] pseries: Fix array overrun bug in PCI code

[patchbot@xxxxxxx]

commit 57ee5f77c09d365d470cd208c76a7a01a85435b2
Author: David Gibson <david@xxxxxxxxxxxxxxxxxxxxx>
Date:   Mon Nov 28 20:21:39 2011 +0000

    pseries: Fix array overrun bug in PCI code
    
    spapr_populate_pci_devices() containd a loop with PCI_NUM_REGIONS (7)
    iterations.  However this overruns the 'bars' global array, which only has
    6 elements. In fact we only want to run this loop for things listed in the
    bars array, so this patch corrects the loop bounds to reflect that.
    
    Signed-off-by: David Gibson <david@xxxxxxxxxxxxxxxxxxxxx>
    Signed-off-by: Alexander Graf <agraf@xxxxxxx>
    (cherry picked from commit 135712de61dfa22368e98914d65b8b0860ec8505)
---
 hw/spapr_pci.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/hw/spapr_pci.c b/hw/spapr_pci.c
index 7162588..9b6a032 100644
--- a/hw/spapr_pci.c
+++ b/hw/spapr_pci.c
@@ -454,7 +454,7 @@ int spapr_populate_pci_devices(sPAPRPHBState *phb,
         reg[0].size = 0;
 
         n = 0;
-        for (i = 0; i < PCI_NUM_REGIONS; ++i) {
+        for (i = 0; i < ARRAY_SIZE(bars); ++i) {
             if (0 == dev->io_regions[i].size) {
                 continue;
             }
--
generated by git-patchbot for /home/xen/git/qemu-upstream-unstable.git

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog