diff options
| author | Cédric Le Goater <clg@fr.ibm.com> | 2016-02-16 09:05:44 +0100 |
|---|---|---|
| committer | Paolo Bonzini <pbonzini@redhat.com> | 2016-02-16 16:41:25 +0100 |
| commit | 73d60fa5fae60c8e07e1f295d8c7fd5d04320160 (patch) | |
| tree | 09837c29dc90de2a14c0c91a81623e4fe024dd50 /hw | |
| parent | 9155b7606a17967b1e056aa5d0433a047f23ae51 (diff) | |
| download | qemu-73d60fa5fae60c8e07e1f295d8c7fd5d04320160.tar.gz qemu-73d60fa5fae60c8e07e1f295d8c7fd5d04320160.tar.bz2 qemu-73d60fa5fae60c8e07e1f295d8c7fd5d04320160.zip | |
ipmi: sensor number should not exceed MAX_SENSORS
Fix a number of off-by-ones, one of them spotted by Coverity.
Signed-off-by: Cédric Le Goater <clg@fr.ibm.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Diffstat (limited to 'hw')
| -rw-r--r-- | hw/ipmi/ipmi_bmc_sim.c | 16 |
1 files changed, 8 insertions, 8 deletions
diff --git a/hw/ipmi/ipmi_bmc_sim.c b/hw/ipmi/ipmi_bmc_sim.c index f8b21761a2..51d234aa1b 100644 --- a/hw/ipmi/ipmi_bmc_sim.c +++ b/hw/ipmi/ipmi_bmc_sim.c @@ -534,7 +534,7 @@ static void ipmi_init_sensors_from_sdrs(IPMIBmcSim *s) continue; /* Not a sensor SDR we set from */ } - if (sdr->sensor_owner_number > MAX_SENSORS) { + if (sdr->sensor_owner_number >= MAX_SENSORS) { continue; } sens = s->sensors + sdr->sensor_owner_number; @@ -1448,7 +1448,7 @@ static void set_sensor_evt_enable(IPMIBmcSim *ibs, IPMISensor *sens; IPMI_CHECK_CMD_LEN(4); - if ((cmd[2] > MAX_SENSORS) || + if ((cmd[2] >= MAX_SENSORS) || !IPMI_SENSOR_GET_PRESENT(ibs->sensors + cmd[2])) { rsp[2] = IPMI_CC_REQ_ENTRY_NOT_PRESENT; return; @@ -1500,7 +1500,7 @@ static void get_sensor_evt_enable(IPMIBmcSim *ibs, IPMISensor *sens; IPMI_CHECK_CMD_LEN(3); - if ((cmd[2] > MAX_SENSORS) || + if ((cmd[2] >= MAX_SENSORS) || !IPMI_SENSOR_GET_PRESENT(ibs->sensors + cmd[2])) { rsp[2] = IPMI_CC_REQ_ENTRY_NOT_PRESENT; return; @@ -1521,7 +1521,7 @@ static void rearm_sensor_evts(IPMIBmcSim *ibs, IPMISensor *sens; IPMI_CHECK_CMD_LEN(4); - if ((cmd[2] > MAX_SENSORS) || + if ((cmd[2] >= MAX_SENSORS) || !IPMI_SENSOR_GET_PRESENT(ibs->sensors + cmd[2])) { rsp[2] = IPMI_CC_REQ_ENTRY_NOT_PRESENT; return; @@ -1543,7 +1543,7 @@ static void get_sensor_evt_status(IPMIBmcSim *ibs, IPMISensor *sens; IPMI_CHECK_CMD_LEN(3); - if ((cmd[2] > MAX_SENSORS) || + if ((cmd[2] >= MAX_SENSORS) || !IPMI_SENSOR_GET_PRESENT(ibs->sensors + cmd[2])) { rsp[2] = IPMI_CC_REQ_ENTRY_NOT_PRESENT; return; @@ -1565,7 +1565,7 @@ static void get_sensor_reading(IPMIBmcSim *ibs, IPMISensor *sens; IPMI_CHECK_CMD_LEN(3); - if ((cmd[2] > MAX_SENSORS) || + if ((cmd[2] >= MAX_SENSORS) || !IPMI_SENSOR_GET_PRESENT(ibs->sensors + cmd[2])) { rsp[2] = IPMI_CC_REQ_ENTRY_NOT_PRESENT; return; @@ -1588,7 +1588,7 @@ static void set_sensor_type(IPMIBmcSim *ibs, IPMI_CHECK_CMD_LEN(5); - if ((cmd[2] > MAX_SENSORS) || + if ((cmd[2] >= MAX_SENSORS) || !IPMI_SENSOR_GET_PRESENT(ibs->sensors + cmd[2])) { rsp[2] = IPMI_CC_REQ_ENTRY_NOT_PRESENT; return; @@ -1607,7 +1607,7 @@ static void get_sensor_type(IPMIBmcSim *ibs, IPMI_CHECK_CMD_LEN(3); - if ((cmd[2] > MAX_SENSORS) || + if ((cmd[2] >= MAX_SENSORS) || !IPMI_SENSOR_GET_PRESENT(ibs->sensors + cmd[2])) { rsp[2] = IPMI_CC_REQ_ENTRY_NOT_PRESENT; return; |