mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

ipmi: sensor number should not exceed MAX_SENSORS

Browse Source 
Fix a number of off-by-ones, one of them spotted by Coverity.

Signed-off-by: Cédric Le Goater <clg@fr.ibm.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
This commit is contained in:
Cédric Le Goater 2016-02-16 09:05:44 +01:00 committed by Paolo Bonzini
parent 9155b7606a
commit 73d60fa5fa
1 changed files with 8 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
hw/ipmi/ipmi_bmc_sim.c
View File

@ -534,7 +534,7 @@ static void ipmi_init_sensors_from_sdrs(IPMIBmcSim *s)
continue; /* Not a sensor SDR we set from */ continue; /* Not a sensor SDR we set from */
} }
if (sdr->sensor_owner_number > MAX_SENSORS) { if (sdr->sensor_owner_number >= MAX_SENSORS) {
continue; continue;
} }
sens = s->sensors + sdr->sensor_owner_number; sens = s->sensors + sdr->sensor_owner_number;
@ -1448,7 +1448,7 @@ static void set_sensor_evt_enable(IPMIBmcSim *ibs,
IPMISensor *sens; IPMISensor *sens;
IPMI_CHECK_CMD_LEN(4); IPMI_CHECK_CMD_LEN(4);
if ((cmd[2] > MAX_SENSORS) || if ((cmd[2] >= MAX_SENSORS) ||
!IPMI_SENSOR_GET_PRESENT(ibs->sensors + cmd[2])) { !IPMI_SENSOR_GET_PRESENT(ibs->sensors + cmd[2])) {
rsp[2] = IPMI_CC_REQ_ENTRY_NOT_PRESENT; rsp[2] = IPMI_CC_REQ_ENTRY_NOT_PRESENT;
return; return;
@ -1500,7 +1500,7 @@ static void get_sensor_evt_enable(IPMIBmcSim *ibs,
IPMISensor *sens; IPMISensor *sens;
IPMI_CHECK_CMD_LEN(3); IPMI_CHECK_CMD_LEN(3);
if ((cmd[2] > MAX_SENSORS) || if ((cmd[2] >= MAX_SENSORS) ||
!IPMI_SENSOR_GET_PRESENT(ibs->sensors + cmd[2])) { !IPMI_SENSOR_GET_PRESENT(ibs->sensors + cmd[2])) {
rsp[2] = IPMI_CC_REQ_ENTRY_NOT_PRESENT; rsp[2] = IPMI_CC_REQ_ENTRY_NOT_PRESENT;
return; return;
@ -1521,7 +1521,7 @@ static void rearm_sensor_evts(IPMIBmcSim *ibs,
IPMISensor *sens; IPMISensor *sens;
IPMI_CHECK_CMD_LEN(4); IPMI_CHECK_CMD_LEN(4);
if ((cmd[2] > MAX_SENSORS) || if ((cmd[2] >= MAX_SENSORS) ||
!IPMI_SENSOR_GET_PRESENT(ibs->sensors + cmd[2])) { !IPMI_SENSOR_GET_PRESENT(ibs->sensors + cmd[2])) {
rsp[2] = IPMI_CC_REQ_ENTRY_NOT_PRESENT; rsp[2] = IPMI_CC_REQ_ENTRY_NOT_PRESENT;
return; return;
@ -1543,7 +1543,7 @@ static void get_sensor_evt_status(IPMIBmcSim *ibs,
IPMISensor *sens; IPMISensor *sens;
IPMI_CHECK_CMD_LEN(3); IPMI_CHECK_CMD_LEN(3);
if ((cmd[2] > MAX_SENSORS) || if ((cmd[2] >= MAX_SENSORS) ||
!IPMI_SENSOR_GET_PRESENT(ibs->sensors + cmd[2])) { !IPMI_SENSOR_GET_PRESENT(ibs->sensors + cmd[2])) {
rsp[2] = IPMI_CC_REQ_ENTRY_NOT_PRESENT; rsp[2] = IPMI_CC_REQ_ENTRY_NOT_PRESENT;
return; return;
@ -1565,7 +1565,7 @@ static void get_sensor_reading(IPMIBmcSim *ibs,
IPMISensor *sens; IPMISensor *sens;
IPMI_CHECK_CMD_LEN(3); IPMI_CHECK_CMD_LEN(3);
if ((cmd[2] > MAX_SENSORS) || if ((cmd[2] >= MAX_SENSORS) ||
!IPMI_SENSOR_GET_PRESENT(ibs->sensors + cmd[2])) { !IPMI_SENSOR_GET_PRESENT(ibs->sensors + cmd[2])) {
rsp[2] = IPMI_CC_REQ_ENTRY_NOT_PRESENT; rsp[2] = IPMI_CC_REQ_ENTRY_NOT_PRESENT;
return; return;
@ -1588,7 +1588,7 @@ static void set_sensor_type(IPMIBmcSim *ibs,
IPMI_CHECK_CMD_LEN(5); IPMI_CHECK_CMD_LEN(5);
if ((cmd[2] > MAX_SENSORS) || if ((cmd[2] >= MAX_SENSORS) ||
!IPMI_SENSOR_GET_PRESENT(ibs->sensors + cmd[2])) { !IPMI_SENSOR_GET_PRESENT(ibs->sensors + cmd[2])) {
rsp[2] = IPMI_CC_REQ_ENTRY_NOT_PRESENT; rsp[2] = IPMI_CC_REQ_ENTRY_NOT_PRESENT;
return; return;
@ -1607,7 +1607,7 @@ static void get_sensor_type(IPMIBmcSim *ibs,
IPMI_CHECK_CMD_LEN(3); IPMI_CHECK_CMD_LEN(3);
if ((cmd[2] > MAX_SENSORS) || if ((cmd[2] >= MAX_SENSORS) ||
!IPMI_SENSOR_GET_PRESENT(ibs->sensors + cmd[2])) { !IPMI_SENSOR_GET_PRESENT(ibs->sensors + cmd[2])) {
rsp[2] = IPMI_CC_REQ_ENTRY_NOT_PRESENT; rsp[2] = IPMI_CC_REQ_ENTRY_NOT_PRESENT;
return; return;