From: Igor Mammedov <imammedo@redhat.com>
Date: Mon, 3 Jun 2013 16:23:27 +0000 (+0200)
Subject: target-i386: cpu: Fix potential buffer overrun in get_register_name_32()
X-Git-Tag: v1.5.1~13
X-Git-Url: https://git.proxmox.com/?p=qemu.git;a=commitdiff_plain;h=c683f1b93444a25e093225751c597dccc2082f8e

target-i386: cpu: Fix potential buffer overrun in get_register_name_32()

Spotted by Coverity,
x86_reg_info_32[] is CPU_NB_REGS32 elements long, so accessing
x86_reg_info_32[CPU_NB_REGS32] will be one element off array.

Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: liguang <lig.fnst@cn.fujitsu.com>
Reviewed by: Jesse Larrew <jlarrew@linux.vnet.ibm.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>
(cherry picked from commit 31ccdde298d98b08526dc23059071c9086dec6c2)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
---

diff --git a/target-i386/cpu.c b/target-i386/cpu.c
index 1a501d9d3..ae8e68271 100644
--- a/target-i386/cpu.c
+++ b/target-i386/cpu.c
@@ -221,7 +221,7 @@ X86RegisterInfo32 x86_reg_info_32[CPU_NB_REGS32] = {
 
 const char *get_register_name_32(unsigned int reg)
 {
-    if (reg > CPU_NB_REGS32) {
+    if (reg >= CPU_NB_REGS32) {
         return NULL;
     }
     return x86_reg_info_32[reg].name;