diff mbox series

[PULL,20/28] hw/block/fdc-isa: Assert that isa_fdc_get_drive_max_chs() found something

Message ID 20240806125157.91185-21-philmd@linaro.org
State Accepted
Commit 11b46661613f847cd0c4070baa2d33c9ff2f3fcd
Headers show
Series [PULL,01/28] hw/intc/loongson_ipi: Rename LoongsonIPI -> LoongsonIPIState | expand

Commit Message

Philippe Mathieu-Daudé Aug. 6, 2024, 12:51 p.m. UTC 
From: Peter Maydell <peter.maydell@linaro.org>

Coverity complains about an overflow in isa_fdc_get_drive_max_chs()
that can happen if the loop over fd_formats never finds a match,
because we initialize *maxc to 0 and then at the end of the
function decrement it.

This can't ever actually happen because fd_formats has at least
one entry for each FloppyDriveType, so we must at least once
find a match and update *maxc, *maxh and *maxs. Assert that we
did find a match, which should keep Coverity happy and will also
detect possible bugs in the data in fd_formats.

Resolves: Coverity CID 1547663
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20240731143617.3391947-6-peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/block/fdc-isa.c | 2 ++
 1 file changed, 2 insertions(+)
diff mbox series

Patch

diff --git a/hw/block/fdc-isa.c b/hw/block/fdc-isa.c
index e43dc532af..796835f57b 100644
--- a/hw/block/fdc-isa.c
+++ b/hw/block/fdc-isa.c
@@ -147,6 +147,8 @@  static void isa_fdc_get_drive_max_chs(FloppyDriveType type, uint8_t *maxc,
             *maxs = fdf->last_sect;
         }
     }
+    /* fd_formats must contain at least one entry per FloppyDriveType */
+    assert(*maxc);
     (*maxc)--;
 }