From 11b46661613f847cd0c4070baa2d33c9ff2f3fcd Mon Sep 17 00:00:00 2001 From: Peter Maydell Date: Wed, 31 Jul 2024 15:36:15 +0100 Subject: [PATCH] hw/block/fdc-isa: Assert that isa_fdc_get_drive_max_chs() found something MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Coverity complains about an overflow in isa_fdc_get_drive_max_chs() that can happen if the loop over fd_formats never finds a match, because we initialize *maxc to 0 and then at the end of the function decrement it. This can't ever actually happen because fd_formats has at least one entry for each FloppyDriveType, so we must at least once find a match and update *maxc, *maxh and *maxs. Assert that we did find a match, which should keep Coverity happy and will also detect possible bugs in the data in fd_formats. Resolves: Coverity CID 1547663 Signed-off-by: Peter Maydell Reviewed-by: Markus Armbruster Reviewed-by: Kevin Wolf Reviewed-by: Philippe Mathieu-Daudé Message-ID: <20240731143617.3391947-6-peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé --- hw/block/fdc-isa.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/hw/block/fdc-isa.c b/hw/block/fdc-isa.c index e43dc532af..796835f57b 100644 --- a/hw/block/fdc-isa.c +++ b/hw/block/fdc-isa.c @@ -147,6 +147,8 @@ static void isa_fdc_get_drive_max_chs(FloppyDriveType type, uint8_t *maxc, *maxs = fdf->last_sect; } } + /* fd_formats must contain at least one entry per FloppyDriveType */ + assert(*maxc); (*maxc)--; }