From b20f8cd11fbfc6e40a00b63e3c2d53549221def0 Mon Sep 17 00:00:00 2001 From: Razvan Cojocaru Date: Wed, 21 Jun 2017 19:37:31 +0300 Subject: [PATCH] x86/monitor: Fixed CID 1412966: Memory - corruptions (OVERRUN) Fixed an issue where the maximum index allowed (31) goes beyond the actual number of array elements (4) of ad->monitor.write_ctrlreg_mask. Coverity-ID: 1412966 Signed-off-by: Razvan Cojocaru Reviewed-by: Andrew Cooper --- xen/arch/x86/monitor.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/xen/arch/x86/monitor.c b/xen/arch/x86/monitor.c index bedf13c74d..764195a7d1 100644 --- a/xen/arch/x86/monitor.c +++ b/xen/arch/x86/monitor.c @@ -132,8 +132,8 @@ int arch_monitor_domctl_event(struct domain *d, unsigned int ctrlreg_bitmask; bool_t old_status; - /* sanity check: avoid left-shift undefined behavior */ - if ( unlikely(mop->u.mov_to_cr.index > 31) ) + if ( unlikely(mop->u.mov_to_cr.index >= + ARRAY_SIZE(ad->monitor.write_ctrlreg_mask)) ) return -EINVAL; if ( unlikely(mop->u.mov_to_cr.pad1 || mop->u.mov_to_cr.pad2) ) -- 2.30.2