@samitouri / QOSamiQemu / commits / 4ac969571b

hw/net/can/flexcan: Fix out-of-bounds access in flexcan_mx_rx()

Require `last_not_free_to_receive_mbid >= 0` before indexing `mbs[]`. This prevents a possible `-1` array index and fixes Coverity CID 1662790. Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Bernhard Beschow <shentey@gmail.com> Tested-by: Pavel Pisa <pisa@fel.cvut.cz> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20260723070059.6332-4-shentey@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Bernhard Beschow committed Jul 27, 2026 at 10:28 UTC 4ac969571b01c0de9d677dfe93647a5f78d44967
1 file changed +1 -1
hw/net/can/flexcan.c
+1 -1
@@ -1075,7 +1075,7 @@ static enum FlexcanRx flexcan_mb_rx(FlexcanState *s, const qemu_can_frame *buf)
1075 }
1076 }
1077
1078 - if (last_not_free_to_receive_mbid >= -1) {
1078 + if (last_not_free_to_receive_mbid >= 0) {
1079 if (last_not_free_to_receive_locked) {
1080 /*
1081 * copy to temporary mailbox (SMB)