Re: [Qemu-devel] [PATCH] sd: Fix out-of-bounds assertions

[Lidong Chen]

Hi Philippe,

On 4/8/2019 2:27 PM, Philippe Mathieu-Daudé wrote:
> Hi Lidong
>
> On 4/8/19 9:04 PM, Lidong Chen wrote:
> > Due to an off-by-one error, the assert statements allow an
> > out-of-bounds array access.
> ... which can't happen. Thus harmless for 4.0.
>
> I suppose this is a static analysis warning and you didn't triggered it
> while tracing.

Right, it was found by the static analysis.  Thank you for your review.

Regards,

Lidong


> Thanks for cleaning this :)
>
> Reviewed-by: Philippe Mathieu-Daudé <address@hidden>
>
> > Signed-off-by: Lidong Chen <address@hidden>
> > ---
> >   hw/sd/sd.c | 4 ++--
> >   1 file changed, 2 insertions(+), 2 deletions(-)
> >
> > diff --git a/hw/sd/sd.c b/hw/sd/sd.c
> > index aaab15f..818f86c 100644
> > --- a/hw/sd/sd.c
> > +++ b/hw/sd/sd.c
> > @@ -144,7 +144,7 @@ static const char *sd_state_name(enum SDCardStates state)
> >       if (state == sd_inactive_state) {
> >           return "inactive";
> >       }
> > -    assert(state <= ARRAY_SIZE(state_name));
> > +    assert(state < ARRAY_SIZE(state_name));
> >       return state_name[state];
> >   }
> >   
> > @@ -165,7 +165,7 @@ static const char *sd_response_name(sd_rsp_type_t rsp)
> >       if (rsp == sd_r1b) {
> >           rsp = sd_r1;
> >       }
> > -    assert(rsp <= ARRAY_SIZE(response_name));
> > +    assert(rsp < ARRAY_SIZE(response_name));
> >       return response_name[rsp];
> >   }
> >