Commit c3d3fad789 for qemu.org

commit c3d3fad789ecd74789819a0e1687396fcfaacf0a
Author: Marc-André Lureau <marcandre.lureau@redhat.com>
Date:   Sun Oct 4 14:23:16 2026 +0400

    audio/dbusaudio: fix off-by-one in volume channel assertion

    The assertion vol->channels < sizeof(vol->vol) rejects the valid case
    where channels exactly equals the array size. Use <= instead.

    Reported-by: Hui Peng <benquike@gmail.com>
    Fixes: 739362d4205c ("audio: add "dbus" audio backend")
    Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
    Message-ID: <20261004-issue-4560-v1-2-ccbef537cbeb@redhat.com>

diff --git a/audio/dbusaudio.c b/audio/dbusaudio.c
index e9bdf6adb5..7d762fe873 100644
--- a/audio/dbusaudio.c
+++ b/audio/dbusaudio.c
@@ -242,7 +242,7 @@ dbus_volume_out_listener(HWVoiceOut *hw,
         return;
     }

-    assert(vol->channels < sizeof(vol->vol));
+    assert(vol->channels <= sizeof(vol->vol));
     bytes = g_bytes_new(vol->vol, vol->channels);
     v_vol = g_variant_new_from_bytes(G_VARIANT_TYPE("ay"), bytes, TRUE);
     qemu_dbus_display1_audio_out_listener_call_set_volume(
@@ -332,7 +332,7 @@ dbus_volume_in_listener(HWVoiceIn *hw,
         return;
     }

-    assert(vol->channels < sizeof(vol->vol));
+    assert(vol->channels <= sizeof(vol->vol));
     bytes = g_bytes_new(vol->vol, vol->channels);
     v_vol = g_variant_new_from_bytes(G_VARIANT_TYPE("ay"), bytes, TRUE);
     qemu_dbus_display1_audio_in_listener_call_set_volume(