From: Andrew Cooper Date: Tue, 25 Jul 2017 18:48:43 +0000 (+0100) Subject: x86/hvm: Fix boundary check in hvmemul_insn_fetch() X-Git-Tag: archive/raspbian/4.11.1-1+rpi1~1^2~66^2~1771 X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=5a992b670bff697c40b513c9e037598ba35ca7d4;p=xen.git x86/hvm: Fix boundary check in hvmemul_insn_fetch() c/s 0943a03037 added some extra protection for overflowing the emulation instruction cache, but Coverity points out that boundary condition is off by one when memcpy()'ing out of the buffer. Signed-off-by: Andrew Cooper Reviewed-by: Paul Durrant --- diff --git a/xen/arch/x86/hvm/emulate.c b/xen/arch/x86/hvm/emulate.c index 99fc4ca34b..087425f835 100644 --- a/xen/arch/x86/hvm/emulate.c +++ b/xen/arch/x86/hvm/emulate.c @@ -958,8 +958,8 @@ int hvmemul_insn_fetch( * Will we overflow insn_buf[]? This shouldn't be able to happen, * which means something went wrong with instruction decoding... */ - if ( insn_off > sizeof(hvmemul_ctxt->insn_buf) || - (insn_off + bytes) > sizeof(hvmemul_ctxt->insn_buf) ) + if ( insn_off >= sizeof(hvmemul_ctxt->insn_buf) || + (insn_off + bytes) >= sizeof(hvmemul_ctxt->insn_buf) ) { ASSERT_UNREACHABLE(); return X86EMUL_UNHANDLEABLE;