diff mbox

[v6,5/7] hw/core: rebase sysbus_get_fw_dev_path() to g_strdup_printf()

Message ID 1434545105-5811-6-git-send-email-lersek@redhat.com
State New
Headers show

Commit Message

Laszlo Ersek June 17, 2015, 12:45 p.m. UTC 
This is done mainly for improving readability, and in preparation for the
next patch, but Markus pointed out another bonus for the string being
returned:

"No arbitrary length limit. Before the patch, it's 39 characters, and the
code breaks catastrophically when qdev_fw_name() is longer: the second
snprintf() is called with its first argument pointing beyond path[], and
its second argument underflowing to a huge size."

Cc: Markus Armbruster <armbru@redhat.com>
Cc: Marcel Apfelbaum <marcel@redhat.com>
Cc: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
Tested-by: Marcel Apfelbaum <marcel@redhat.com>
Reviewed-by: Marcel Apfelbaum <marcel@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
---

Notes:
    v6:
    - no changes
    
    v5:
    - separate "%s@" from TARGET_FMT_plx with a space [Markus]
    - copied Markus's note about "no arbitrary length limit" on the retval
      into the commit message
    
    v4:
    - unchanged
    
    v3:
    - new in v3

 hw/core/sysbus.c | 16 ++++++----------
 1 file changed, 6 insertions(+), 10 deletions(-)

Comments

Michael S. Tsirkin June 17, 2015, 1:46 p.m. UTC | #1 
On Wed, Jun 17, 2015 at 02:45:03PM +0200, Laszlo Ersek wrote:
> This is done mainly for improving readability, and in preparation for the
> next patch, but Markus pointed out another bonus for the string being
> returned:
> 
> "No arbitrary length limit. Before the patch, it's 39 characters, and the
> code breaks catastrophically when qdev_fw_name() is longer: the second
> snprintf() is called with its first argument pointing beyond path[], and
> its second argument underflowing to a huge size."
> 
> Cc: Markus Armbruster <armbru@redhat.com>
> Cc: Marcel Apfelbaum <marcel@redhat.com>
> Cc: Michael S. Tsirkin <mst@redhat.com>
> Signed-off-by: Laszlo Ersek <lersek@redhat.com>
> Tested-by: Marcel Apfelbaum <marcel@redhat.com>
> Reviewed-by: Marcel Apfelbaum <marcel@redhat.com>
> Reviewed-by: Markus Armbruster <armbru@redhat.com>

Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

In fact, I'd Cc stable on this one.

> ---
> 
> Notes:
>     v6:
>     - no changes
>     
>     v5:
>     - separate "%s@" from TARGET_FMT_plx with a space [Markus]
>     - copied Markus's note about "no arbitrary length limit" on the retval
>       into the commit message
>     
>     v4:
>     - unchanged
>     
>     v3:
>     - new in v3
> 
>  hw/core/sysbus.c | 16 ++++++----------
>  1 file changed, 6 insertions(+), 10 deletions(-)
> 
> diff --git a/hw/core/sysbus.c b/hw/core/sysbus.c
> index b53c351..92eced9 100644
> --- a/hw/core/sysbus.c
> +++ b/hw/core/sysbus.c
> @@ -281,19 +281,15 @@ static void sysbus_dev_print(Monitor *mon, DeviceState *dev, int indent)
>  static char *sysbus_get_fw_dev_path(DeviceState *dev)
>  {
>      SysBusDevice *s = SYS_BUS_DEVICE(dev);
> -    char path[40];
> -    int off;
> -
> -    off = snprintf(path, sizeof(path), "%s", qdev_fw_name(dev));
>  
>      if (s->num_mmio) {
> -        snprintf(path + off, sizeof(path) - off, "@"TARGET_FMT_plx,
> -                 s->mmio[0].addr);
> -    } else if (s->num_pio) {
> -        snprintf(path + off, sizeof(path) - off, "@i%04x", s->pio[0]);
> +        return g_strdup_printf("%s@" TARGET_FMT_plx, qdev_fw_name(dev),
> +                               s->mmio[0].addr);
>      }
> -
> -    return g_strdup(path);
> +    if (s->num_pio) {
> +        return g_strdup_printf("%s@i%04x", qdev_fw_name(dev), s->pio[0]);
> +    }
> +    return g_strdup(qdev_fw_name(dev));
>  }
>  
>  void sysbus_add_io(SysBusDevice *dev, hwaddr addr,
> -- 
> 1.8.3.1
>
Laszlo Ersek June 17, 2015, 1:56 p.m. UTC | #2 
On 06/17/15 15:46, Michael S. Tsirkin wrote:
> On Wed, Jun 17, 2015 at 02:45:03PM +0200, Laszlo Ersek wrote:
>> This is done mainly for improving readability, and in preparation for the
>> next patch, but Markus pointed out another bonus for the string being
>> returned:
>>
>> "No arbitrary length limit. Before the patch, it's 39 characters, and the
>> code breaks catastrophically when qdev_fw_name() is longer: the second
>> snprintf() is called with its first argument pointing beyond path[], and
>> its second argument underflowing to a huge size."
>>
>> Cc: Markus Armbruster <armbru@redhat.com>
>> Cc: Marcel Apfelbaum <marcel@redhat.com>
>> Cc: Michael S. Tsirkin <mst@redhat.com>
>> Signed-off-by: Laszlo Ersek <lersek@redhat.com>
>> Tested-by: Marcel Apfelbaum <marcel@redhat.com>
>> Reviewed-by: Marcel Apfelbaum <marcel@redhat.com>
>> Reviewed-by: Markus Armbruster <armbru@redhat.com>
> 
> Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
> 
> In fact, I'd Cc stable on this one.

Will do, thanks.

Laszlo

> 
>> ---
>>
>> Notes:
>>     v6:
>>     - no changes
>>     
>>     v5:
>>     - separate "%s@" from TARGET_FMT_plx with a space [Markus]
>>     - copied Markus's note about "no arbitrary length limit" on the retval
>>       into the commit message
>>     
>>     v4:
>>     - unchanged
>>     
>>     v3:
>>     - new in v3
>>
>>  hw/core/sysbus.c | 16 ++++++----------
>>  1 file changed, 6 insertions(+), 10 deletions(-)
>>
>> diff --git a/hw/core/sysbus.c b/hw/core/sysbus.c
>> index b53c351..92eced9 100644
>> --- a/hw/core/sysbus.c
>> +++ b/hw/core/sysbus.c
>> @@ -281,19 +281,15 @@ static void sysbus_dev_print(Monitor *mon, DeviceState *dev, int indent)
>>  static char *sysbus_get_fw_dev_path(DeviceState *dev)
>>  {
>>      SysBusDevice *s = SYS_BUS_DEVICE(dev);
>> -    char path[40];
>> -    int off;
>> -
>> -    off = snprintf(path, sizeof(path), "%s", qdev_fw_name(dev));
>>  
>>      if (s->num_mmio) {
>> -        snprintf(path + off, sizeof(path) - off, "@"TARGET_FMT_plx,
>> -                 s->mmio[0].addr);
>> -    } else if (s->num_pio) {
>> -        snprintf(path + off, sizeof(path) - off, "@i%04x", s->pio[0]);
>> +        return g_strdup_printf("%s@" TARGET_FMT_plx, qdev_fw_name(dev),
>> +                               s->mmio[0].addr);
>>      }
>> -
>> -    return g_strdup(path);
>> +    if (s->num_pio) {
>> +        return g_strdup_printf("%s@i%04x", qdev_fw_name(dev), s->pio[0]);
>> +    }
>> +    return g_strdup(qdev_fw_name(dev));
>>  }
>>  
>>  void sysbus_add_io(SysBusDevice *dev, hwaddr addr,
>> -- 
>> 1.8.3.1
>>
diff mbox

Patch

diff --git a/hw/core/sysbus.c b/hw/core/sysbus.c
index b53c351..92eced9 100644
--- a/hw/core/sysbus.c
+++ b/hw/core/sysbus.c
@@ -281,19 +281,15 @@  static void sysbus_dev_print(Monitor *mon, DeviceState *dev, int indent)
 static char *sysbus_get_fw_dev_path(DeviceState *dev)
 {
     SysBusDevice *s = SYS_BUS_DEVICE(dev);
-    char path[40];
-    int off;
-
-    off = snprintf(path, sizeof(path), "%s", qdev_fw_name(dev));
 
     if (s->num_mmio) {
-        snprintf(path + off, sizeof(path) - off, "@"TARGET_FMT_plx,
-                 s->mmio[0].addr);
-    } else if (s->num_pio) {
-        snprintf(path + off, sizeof(path) - off, "@i%04x", s->pio[0]);
+        return g_strdup_printf("%s@" TARGET_FMT_plx, qdev_fw_name(dev),
+                               s->mmio[0].addr);
     }
-
-    return g_strdup(path);
+    if (s->num_pio) {
+        return g_strdup_printf("%s@i%04x", qdev_fw_name(dev), s->pio[0]);
+    }
+    return g_strdup(qdev_fw_name(dev));
 }
 
 void sysbus_add_io(SysBusDevice *dev, hwaddr addr,