hw/net/can/flexcan: Fix out-of-bounds access in flexcan_mx_rx()
Require `last_not_free_to_receive_mbid >= 0` before indexing `mbs[]`. This prevents a possible `-1` array index and fixes Coverity CID 1662790. Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Bernhard Beschow <shentey@gmail.com> Tested-by: Pavel Pisa <pisa@fel.cvut.cz> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20260723070059.6332-4-shentey@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Bernhard Beschow committed
Jul 27, 2026 at 10:28 UTC
4ac969571b01c0de9d677dfe93647a5f78d44967
1 file changed
+1
-1
hw/net/can/flexcan.c
+1
-1
@@ -1075,7 +1075,7 @@ static enum FlexcanRx flexcan_mb_rx(FlexcanState *s, const qemu_can_frame *buf)
1075
}
1076
}
1077
1078
- if (last_not_free_to_receive_mbid >= -1) {
1078
+ if (last_not_free_to_receive_mbid >= 0) {
1079
if (last_not_free_to_receive_locked) {
1080
/*
1081
* copy to temporary mailbox (SMB)