From 1c598ab2b88571d8c75cfebbef09d4c1c675132c Mon Sep 17 00:00:00 2001 From: Lidong Chen Date: Wed, 19 Jun 2019 15:14:46 -0400 Subject: [PATCH] sd: Fix out-of-bounds assertions MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit Due to an off-by-one error, the assert statements allow an out-of-bound array access. This doesn't happen in practice, but the static analyzer notices. Signed-off-by: Lidong Chen Reviewed-by: Liam Merwick Reviewed-by: Marc-André Lureau Reviewed-by: Philippe Mathieu-Daudé Reviewed-by: Li Qiang Reviewed-by: Darren Kenny Message-Id: <6b19cb7359a10a6bedc3ea0fce22fed3ef93c102.1560806687.git.lidong.chen@oracle.com> Signed-off-by: Paolo Bonzini --- hw/sd/sd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/hw/sd/sd.c b/hw/sd/sd.c index 60500ec8fe..917195a65b 100644 --- a/hw/sd/sd.c +++ b/hw/sd/sd.c @@ -145,7 +145,7 @@ static const char *sd_state_name(enum SDCardStates state) if (state == sd_inactive_state) { return "inactive"; } - assert(state <= ARRAY_SIZE(state_name)); + assert(state < ARRAY_SIZE(state_name)); return state_name[state]; } @@ -166,7 +166,7 @@ static const char *sd_response_name(sd_rsp_type_t rsp) if (rsp == sd_r1b) { rsp = sd_r1; } - assert(rsp <= ARRAY_SIZE(response_name)); + assert(rsp < ARRAY_SIZE(response_name)); return response_name[rsp]; } -- 2.11.0