From: Jan Beulich <jbeulich@suse.com>
Date: Thu, 10 Aug 2017 10:37:24 +0000 (+0200)
Subject: x86/HVM: fix boundary check in hvmemul_insn_fetch() (again)
X-Git-Tag: archive/raspbian/4.11.1-1+rpi1~1^2~66^2~1705
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=58e8986267d976b00c60e0089baa2e5f66f16d3e;p=xen.git

x86/HVM: fix boundary check in hvmemul_insn_fetch() (again)

Commit 5a992b670b ("x86/hvm: Fix boundary check in
hvmemul_insn_fetch()") went a little too far in its correction to
commit 0943a03037 ("x86/hvm: Fixes to hvmemul_insn_fetch()"): Keep the
start offset check, but restore the original end offset one.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Paul Durrant <paul.durrant@citrix.com>
---

diff --git a/xen/arch/x86/hvm/emulate.c b/xen/arch/x86/hvm/emulate.c
index 087425f835..64454c7825 100644
--- a/xen/arch/x86/hvm/emulate.c
+++ b/xen/arch/x86/hvm/emulate.c
@@ -959,7 +959,7 @@ int hvmemul_insn_fetch(
              * which means something went wrong with instruction decoding...
              */
             if ( insn_off >= sizeof(hvmemul_ctxt->insn_buf) ||
-                 (insn_off + bytes) >= sizeof(hvmemul_ctxt->insn_buf) )
+                 insn_off + bytes > sizeof(hvmemul_ctxt->insn_buf) )
             {
                 ASSERT_UNREACHABLE();
                 return X86EMUL_UNHANDLEABLE;