Message ID | 20170717151334.17954-1-eblake@redhat.com |
---|---|
State | New |
Headers | show |
On 07/17/2017 12:13 PM, Eric Blake wrote: > gcc 7 is pickier about our sources: > > hw/usb/bus.c: In function ‘usb_port_location’: > hw/usb/bus.c:410:66: error: ‘%d’ directive output may be truncated writing between 1 and 11 bytes into a region of size between 0 and 15 [-Werror=format-truncation=] > snprintf(downstream->path, sizeof(downstream->path), "%s.%d", > ^~ > hw/usb/bus.c:410:9: note: ‘snprintf’ output between 3 and 28 bytes into a destination of size 16 > snprintf(downstream->path, sizeof(downstream->path), "%s.%d", > ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > upstream->path, portnr); > ~~~~~~~~~~~~~~~~~~~~~~~ > > But we know that there are at most 5 levels of USB hubs, with at > most two digits per level; that plus the separating dots means we > use at most 15 bytes (including trailing NUL) of our 16-byte field. > Adding an assertion to show gcc that we checked for truncation is > enough to shut up the false-positive warning. > > Inspired by an idea by Dr. David Alan Gilbert <dgilbert@redhat.com>. elegant :) > > Signed-off-by: Eric Blake <eblake@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> > --- > hw/usb/bus.c | 6 ++++-- > 1 file changed, 4 insertions(+), 2 deletions(-) > > diff --git a/hw/usb/bus.c b/hw/usb/bus.c > index 5939b273b9..d910f849e7 100644 > --- a/hw/usb/bus.c > +++ b/hw/usb/bus.c > @@ -407,8 +407,10 @@ void usb_register_companion(const char *masterbus, USBPort *ports[], > void usb_port_location(USBPort *downstream, USBPort *upstream, int portnr) > { > if (upstream) { > - snprintf(downstream->path, sizeof(downstream->path), "%s.%d", > - upstream->path, portnr); > + int l = snprintf(downstream->path, sizeof(downstream->path), "%s.%d", > + upstream->path, portnr); > + /* Max string is nn.nn.nn.nn.nn, which fits in 16 bytes */ > + assert(l < sizeof(downstream->path)); > downstream->hubcount = upstream->hubcount + 1; > } else { > snprintf(downstream->path, sizeof(downstream->path), "%d", portnr); >
diff --git a/hw/usb/bus.c b/hw/usb/bus.c index 5939b273b9..d910f849e7 100644 --- a/hw/usb/bus.c +++ b/hw/usb/bus.c @@ -407,8 +407,10 @@ void usb_register_companion(const char *masterbus, USBPort *ports[], void usb_port_location(USBPort *downstream, USBPort *upstream, int portnr) { if (upstream) { - snprintf(downstream->path, sizeof(downstream->path), "%s.%d", - upstream->path, portnr); + int l = snprintf(downstream->path, sizeof(downstream->path), "%s.%d", + upstream->path, portnr); + /* Max string is nn.nn.nn.nn.nn, which fits in 16 bytes */ + assert(l < sizeof(downstream->path)); downstream->hubcount = upstream->hubcount + 1; } else { snprintf(downstream->path, sizeof(downstream->path), "%d", portnr);
gcc 7 is pickier about our sources: hw/usb/bus.c: In function ‘usb_port_location’: hw/usb/bus.c:410:66: error: ‘%d’ directive output may be truncated writing between 1 and 11 bytes into a region of size between 0 and 15 [-Werror=format-truncation=] snprintf(downstream->path, sizeof(downstream->path), "%s.%d", ^~ hw/usb/bus.c:410:9: note: ‘snprintf’ output between 3 and 28 bytes into a destination of size 16 snprintf(downstream->path, sizeof(downstream->path), "%s.%d", ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ upstream->path, portnr); ~~~~~~~~~~~~~~~~~~~~~~~ But we know that there are at most 5 levels of USB hubs, with at most two digits per level; that plus the separating dots means we use at most 15 bytes (including trailing NUL) of our 16-byte field. Adding an assertion to show gcc that we checked for truncation is enough to shut up the false-positive warning. Inspired by an idea by Dr. David Alan Gilbert <dgilbert@redhat.com>. Signed-off-by: Eric Blake <eblake@redhat.com> --- hw/usb/bus.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)