From a66f5a81000dd8efcdcae8f4a996e185d0701c49 Mon Sep 17 00:00:00 2001 From: Stewart Smith Date: Mon, 3 Jun 2019 17:41:21 +1000 Subject: hw/lpc: Fix theoretical possible out-of-bounds-read number of elements versus starting counting from 0. Found by static analysis. Signed-off-by: Stewart Smith --- hw/lpc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'hw') diff --git a/hw/lpc.c b/hw/lpc.c index 3f2300c..3f5109d 100644 --- a/hw/lpc.c +++ b/hw/lpc.c @@ -519,7 +519,7 @@ static int64_t lpc_probe_test(struct lpcm *lpc) /* Ensure we can perform a valid lookup in the error table */ idx = LPC_ERROR_IDX(irqstat); - if (idx < 0 || idx > ARRAY_SIZE(lpc_error_table)) { + if (idx < 0 || idx >= ARRAY_SIZE(lpc_error_table)) { prerror("LPC bus error translation failed with status 0x%x\n", irqstat); return OPAL_PARAMETER; @@ -1035,7 +1035,7 @@ static void lpc_dispatch_err_irqs(struct lpcm *lpc, uint32_t irqs) /* Ensure we can perform a valid lookup in the error table */ idx = LPC_ERROR_IDX(irqs); - if (idx < 0 || idx > ARRAY_SIZE(lpc_error_table)) { + if (idx < 0 || idx >= ARRAY_SIZE(lpc_error_table)) { prerror("LPC bus error translation failed with status 0x%x\n", irqs); return; -- cgit v1.1