On 13/10/25 13:10, Markus Armbruster wrote:
Ping?
Markus Armbruster <[email protected]> writes:
xenfb_mouse_event() has a switch statement whose controlling
expression move->axis is an enum InputAxis. The enum values are
INPUT_AXIS_X and INPUT_AXIS_Y, encoded as 0 and 1. The switch has a
case for both axes. In addition, it has an unreachable default label.
This convinces Coverity that move->axis can be greater than 1. It
duly reports a buffer overrun when it is used to subscript an array
with two elements.
Replace the unreachable code by abort().
Resolves: Coverity CID 1613906
Signed-off-by: Markus Armbruster <[email protected]>
---
hw/display/xenfb.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
and queued with g_assert_not_reached(), thanks!
