Commit 9c6c5b4812 for qemu.org

commit 9c6c5b481230ef2d527a4e224d4df2cf95571d1f
Author: Marc-André Lureau <marcandre.lureau@redhat.com>
Date:   Sun Oct 4 14:23:17 2026 +0400

    audio/ossaudio: fix off-by-one in mmap buffer size assertion

    oss_put_buffer_out() asserts size < hw->size_emul, but a write that
    fills the entire buffer (size == size_emul) is valid. Use <= instead.

    Reported-by: Hui Peng <benquike@gmail.com>
    Fixes: 3ba4066d085f ("ossaudio: port to the new audio backend api")
    Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
    Message-ID: <20261004-issue-4560-v1-3-ccbef537cbeb@redhat.com>

diff --git a/audio/ossaudio.c b/audio/ossaudio.c
index 95a07ea1ca..e35eab3110 100644
--- a/audio/ossaudio.c
+++ b/audio/ossaudio.c
@@ -393,7 +393,7 @@ static size_t oss_put_buffer_out(HWVoiceOut *hw, void *buf, size_t size)
 {
     OSSVoiceOut *oss = (OSSVoiceOut *) hw;
     if (oss->mmapped) {
-        assert(buf == hw->buf_emul + hw->pos_emul && size < hw->size_emul);
+        assert(buf == hw->buf_emul + hw->pos_emul && size <= hw->size_emul);

         hw->pos_emul = (hw->pos_emul + size) % hw->size_emul;
         return size;