svn commit: r267607 - head/sys/x86/xen

[Roger Pau Monné]

Author: royger
Date: Wed Jun 18 13:41:20 2014
New Revision: 267607
URL: http://svnweb.freebsd.org/changeset/base/267607

Log:
  xen: fix out-of-bounds access to ipi_handle
  
  Fix the gate in xen_pv_lapic_ipi_vectored to prevent access to element
  at position nitems(xen_ipis).
  
  Sponsored by: Citrix Systems R&D
  Coverity ID: 1223203
  Approved by: gibbs

Modified:
  head/sys/x86/xen/xen_apic.c

Modified: head/sys/x86/xen/xen_apic.c
==============================================================================
--- head/sys/x86/xen/xen_apic.c	Wed Jun 18 12:26:02 2014	(r267606)
+++ head/sys/x86/xen/xen_apic.c	Wed Jun 18 13:41:20 2014	(r267607)
@@ -272,7 +272,7 @@ xen_pv_lapic_ipi_vectored(u_int vector, 
 	int ipi_idx, to_cpu, self;
 
 	ipi_idx = IPI_TO_IDX(vector);
-	if (ipi_idx > nitems(xen_ipis))
+	if (ipi_idx >= nitems(xen_ipis))
 		panic("IPI out of range");
 
 	switch(dest) {