Re: [Qemu-devel] [PATCH 3/4] pcnet: fix Negative array index read

2014-11-20 Thread Paolo Bonzini
On 20/11/2014 08:38, Gonglei wrote: On 2014/11/20 15:08, Paolo Bonzini wrote: On 20/11/2014 07:44, Gonglei wrote: Maybe not, since two branch are if and else if not if and else, so this change make the below code segment's wide ... bcnt = 4096 - GET_FIELD(tmd.length, TMDL, BCNT);

[Qemu-devel] [PATCH 3/4] pcnet: fix Negative array index read

2014-11-19 Thread arei.gonglei
From: Gonglei arei.gong...@huawei.com s-xmit_pos maybe assigned to a negative value (-1), but in this branch variable s-xmit_pos as an index to array s-buffer. Let's add a check for s-xmit_pos. Signed-off-by: Gonglei arei.gong...@huawei.com --- hw/net/pcnet.c | 2 +- 1 file changed, 1

Re: [Qemu-devel] [PATCH 3/4] pcnet: fix Negative array index read

2014-11-19 Thread Jason Wang
On 11/20/2014 01:57 PM, arei.gong...@huawei.com wrote: From: Gonglei arei.gong...@huawei.com s-xmit_pos maybe assigned to a negative value (-1), but in this branch variable s-xmit_pos as an index to array s-buffer. Let's add a check for s-xmit_pos. Signed-off-by: Gonglei

Re: [Qemu-devel] [PATCH 3/4] pcnet: fix Negative array index read

2014-11-19 Thread Paolo Bonzini
On 20/11/2014 06:57, arei.gong...@huawei.com wrote: From: Gonglei arei.gong...@huawei.com s-xmit_pos maybe assigned to a negative value (-1), but in this branch variable s-xmit_pos as an index to array s-buffer. Let's add a check for s-xmit_pos. Signed-off-by: Gonglei

Re: [Qemu-devel] [PATCH 3/4] pcnet: fix Negative array index read

2014-11-19 Thread Gonglei
On 2014/11/20 14:36, Paolo Bonzini wrote: On 20/11/2014 06:57, arei.gong...@huawei.com wrote: From: Gonglei arei.gong...@huawei.com s-xmit_pos maybe assigned to a negative value (-1), but in this branch variable s-xmit_pos as an index to array s-buffer. Let's add a check for s-xmit_pos.

Re: [Qemu-devel] [PATCH 3/4] pcnet: fix Negative array index read

2014-11-19 Thread Paolo Bonzini
On 20/11/2014 07:44, Gonglei wrote: Maybe not, since two branch are if and else if not if and else, so this change make the below code segment's wide ... bcnt = 4096 - GET_FIELD(tmd.length, TMDL, BCNT); s-phys_mem_read(s-dma_opaque, PHYSADDR(s, tmd.tbadr),

Re: [Qemu-devel] [PATCH 3/4] pcnet: fix Negative array index read

2014-11-19 Thread Gonglei
On 2014/11/20 15:08, Paolo Bonzini wrote: On 20/11/2014 07:44, Gonglei wrote: Maybe not, since two branch are if and else if not if and else, so this change make the below code segment's wide ... bcnt = 4096 - GET_FIELD(tmd.length, TMDL, BCNT); s-phys_mem_read(s-dma_opaque,