diff options
| author | Greg Kurz <groug@kaod.org> | 2016-06-27 18:28:15 +0200 |
|---|---|---|
| committer | David Gibson <david@gibson.dropbear.id.au> | 2016-07-01 09:57:01 +1000 |
| commit | dde35bc966ef8c1afb4f4e0f3c0e99fc0f27ca04 (patch) | |
| tree | fe272a607d788d49c0483c484c1ac42a339731fa | |
| parent | 6cc09e261b267e5b06c03efdf0c8e7a0d9e59721 (diff) | |
| download | qemu-dde35bc966ef8c1afb4f4e0f3c0e99fc0f27ca04.tar.gz | |
spapr: fix write-past-end-of-array error in cpu core device init code
This fixes a potential QEMU crash introduced by commit 3b542549661.
Signed-off-by: Greg Kurz <groug@kaod.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
| -rw-r--r-- | hw/ppc/spapr_cpu_core.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/hw/ppc/spapr_cpu_core.c b/hw/ppc/spapr_cpu_core.c index 3a5da09b99..8b802a6fcf 100644 --- a/hw/ppc/spapr_cpu_core.c +++ b/hw/ppc/spapr_cpu_core.c @@ -309,10 +309,9 @@ static void spapr_cpu_core_realize(DeviceState *dev, Error **errp) } err: - while (i >= 0) { + while (--i >= 0) { obj = sc->threads + i * size; object_unparent(obj); - i--; } g_free(sc->threads); error_propagate(errp, local_err); |