From 58e8986267d976b00c60e0089baa2e5f66f16d3e Mon Sep 17 00:00:00 2001 From: Jan Beulich Date: Thu, 10 Aug 2017 12:37:24 +0200 Subject: [PATCH] x86/HVM: fix boundary check in hvmemul_insn_fetch() (again) Commit 5a992b670b ("x86/hvm: Fix boundary check in hvmemul_insn_fetch()") went a little too far in its correction to commit 0943a03037 ("x86/hvm: Fixes to hvmemul_insn_fetch()"): Keep the start offset check, but restore the original end offset one. Signed-off-by: Jan Beulich Reviewed-by: Paul Durrant --- xen/arch/x86/hvm/emulate.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xen/arch/x86/hvm/emulate.c b/xen/arch/x86/hvm/emulate.c index 087425f835..64454c7825 100644 --- a/xen/arch/x86/hvm/emulate.c +++ b/xen/arch/x86/hvm/emulate.c @@ -959,7 +959,7 @@ int hvmemul_insn_fetch( * which means something went wrong with instruction decoding... */ if ( insn_off >= sizeof(hvmemul_ctxt->insn_buf) || - (insn_off + bytes) >= sizeof(hvmemul_ctxt->insn_buf) ) + insn_off + bytes > sizeof(hvmemul_ctxt->insn_buf) ) { ASSERT_UNREACHABLE(); return X86EMUL_UNHANDLEABLE; -- 2.30.2