There was an off-by-1 in the qcode conversion array bounds check. Fixes: e709a61a8fe1076a487376fd657544418a38ba06 Reported-by: Peter Maydell <peter.maydell@xxxxxxxxxx> Reviewed-by: Peter Maydell <peter.maydell@xxxxxxxxxx> Signed-off-by: Daniel P. Berrangé <berrange@xxxxxxxxxx> --- hw/char/escc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/char/escc.c b/hw/char/escc.c index 8755d8d34f..17a908c59b 100644 --- a/hw/char/escc.c +++ b/hw/char/escc.c @@ -828,7 +828,7 @@ static void sunkbd_handle_event(DeviceState *dev, QemuConsole *src, } } - if (qcode > qemu_input_map_qcode_to_sun_len) { + if (qcode >= qemu_input_map_qcode_to_sun_len) { return; } -- 2.35.1