{"id":811514,"url":"http://patchwork.ozlabs.org/api/patches/811514/?format=json","web_url":"http://patchwork.ozlabs.org/project/qemu-devel/patch/20170908103558.31632-6-david@gibson.dropbear.id.au/","project":{"id":14,"url":"http://patchwork.ozlabs.org/api/projects/14/?format=json","name":"QEMU Development","link_name":"qemu-devel","list_id":"qemu-devel.nongnu.org","list_email":"qemu-devel@nongnu.org","web_url":"","scm_url":"","webscm_url":"","list_archive_url":"","list_archive_url_format":"","commit_url_format":""},"msgid":"<20170908103558.31632-6-david@gibson.dropbear.id.au>","list_archive_url":null,"date":"2017-09-08T10:35:23","name":"[PULL,05/40] spapr_iommu: use g_strdup_printf() instead of snprintf()","commit_ref":null,"pull_url":null,"state":"new","archived":false,"hash":"9bf4a4d3bd38609a1c68266289c7df091829f2cf","submitter":{"id":47,"url":"http://patchwork.ozlabs.org/api/people/47/?format=json","name":"David Gibson","email":"david@gibson.dropbear.id.au"},"delegate":null,"mbox":"http://patchwork.ozlabs.org/project/qemu-devel/patch/20170908103558.31632-6-david@gibson.dropbear.id.au/mbox/","series":[{"id":2179,"url":"http://patchwork.ozlabs.org/api/series/2179/?format=json","web_url":"http://patchwork.ozlabs.org/project/qemu-devel/list/?series=2179","date":"2017-09-08T10:35:20","name":"[PULL,01/40] hw/ppc/spapr_drc.c: change spapr_drc_needed to use drc->dev","version":1,"mbox":"http://patchwork.ozlabs.org/series/2179/mbox/"}],"comments":"http://patchwork.ozlabs.org/api/patches/811514/comments/","check":"pending","checks":"http://patchwork.ozlabs.org/api/patches/811514/checks/","tags":{},"related":[],"headers":{"Return-Path":"","X-Original-To":"incoming@patchwork.ozlabs.org","Delivered-To":"patchwork-incoming@bilbo.ozlabs.org","Authentication-Results":["ozlabs.org;\n\tspf=pass (mailfrom) smtp.mailfrom=nongnu.org\n\t(client-ip=2001:4830:134:3::11; helo=lists.gnu.org;\n\tenvelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org;\n\treceiver=)","ozlabs.org;\n\tdkim=fail reason=\"signature verification failed\" (1024-bit key;\n\tunprotected) header.d=gibson.dropbear.id.au\n\theader.i=@gibson.dropbear.id.au header.b=\"XIZT08jz\"; \n\tdkim-atps=neutral"],"Received":["from lists.gnu.org (lists.gnu.org [IPv6:2001:4830:134:3::11])\n\t(using TLSv1 with cipher AES256-SHA (256/256 bits))\n\t(No client certificate requested)\n\tby ozlabs.org (Postfix) with ESMTPS id 3xpYy0625Wz9s3w\n\tfor ;\n\tFri, 8 Sep 2017 20:50:32 +1000 (AEST)","from localhost ([::1]:44512 helo=lists.gnu.org)\n\tby lists.gnu.org with esmtp (Exim 4.71) (envelope-from\n\t)\n\tid 1dqGrm-0006Uj-Sp\n\tfor incoming@patchwork.ozlabs.org; Fri, 08 Sep 2017 06:50:30 -0400","from eggs.gnu.org ([2001:4830:134:3::10]:58609)\n\tby lists.gnu.org with esmtp (Exim 4.71)\n\t(envelope-from ) id 1dqGe2-00026J-HB\n\tfor qemu-devel@nongnu.org; Fri, 08 Sep 2017 06:36:25 -0400","from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)\n\t(envelope-from ) id 1dqGdx-0003Ak-Cg\n\tfor qemu-devel@nongnu.org; Fri, 08 Sep 2017 06:36:18 -0400","from ozlabs.org ([103.22.144.67]:40049)\n\tby eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32)\n\t(Exim 4.71) (envelope-from )\n\tid 1dqGdw-00038C-Ph; Fri, 08 Sep 2017 06:36:13 -0400","by ozlabs.org (Postfix, from userid 1007)\n\tid 3xpYdJ0dY6z9t2V; Fri, 8 Sep 2017 20:36:03 +1000 (AEST)"],"DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/simple;\n\td=gibson.dropbear.id.au; s=201602; t=1504866964;\n\tbh=fXjfyOOPPBLNaks2Id+bE26YiARS5qGcNmP/WKdYicA=;\n\th=From:To:Cc:Subject:Date:In-Reply-To:References:From;\n\tb=XIZT08jzPtvGy+MLaJTB8wSNvhMuEmQcKdScZZ2MA5jiYkMiFAJlpsul6jv49vzP2\n\tdSUFCURUVieBjamvR+/pg7Z2Nd7jhszLHTReL2PcdAgvvquk+3VqtbC+g5vkcsIidO\n\tDbMX7Q9fVyTfYldRxv9JM0oL4qXqw5uLto8yvtps=","From":"David Gibson ","To":"peter.maydell@linaro.org","Date":"Fri, 8 Sep 2017 20:35:23 +1000","Message-Id":"<20170908103558.31632-6-david@gibson.dropbear.id.au>","X-Mailer":"git-send-email 2.13.5","In-Reply-To":"<20170908103558.31632-1-david@gibson.dropbear.id.au>","References":"<20170908103558.31632-1-david@gibson.dropbear.id.au>","X-detected-operating-system":"by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic]\n\t[fuzzy]","X-Received-From":"103.22.144.67","Subject":"[Qemu-devel] [PULL 05/40] spapr_iommu: use g_strdup_printf()\n\tinstead of snprintf()","X-BeenThere":"qemu-devel@nongnu.org","X-Mailman-Version":"2.1.21","Precedence":"list","List-Id":"","List-Unsubscribe":",\n\t","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n\t","Cc":"qemu-devel@nongnu.org, aik@ozlabs.ru, agraf@suse.de,\n\tmdroth@linux.vnet.ibm.com, Greg Kurz ,\n\tqemu-ppc@nongnu.org, imammedo@redhat.com, sam.bobroff@au1.ibm.com,\n\tDavid Gibson ","Errors-To":"qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org","Sender":"\"Qemu-devel\"\n\t"},"content":"From: Greg Kurz \n\nPassing a stack allocated buffer of arbitrary length to snprintf()\nwithout checking the return value can cause the resultant strings\nto be silently truncated.\n\nSigned-off-by: Greg Kurz \nSigned-off-by: David Gibson \n---\n hw/ppc/spapr_iommu.c | 13 ++++++++-----\n 1 file changed, 8 insertions(+), 5 deletions(-)","diff":"diff --git a/hw/ppc/spapr_iommu.c b/hw/ppc/spapr_iommu.c\nindex ed2d53559a..ed4388bd75 100644\n--- a/hw/ppc/spapr_iommu.c\n+++ b/hw/ppc/spapr_iommu.c\n@@ -252,17 +252,19 @@ static int spapr_tce_table_realize(DeviceState *dev)\n {\n sPAPRTCETable *tcet = SPAPR_TCE_TABLE(dev);\n Object *tcetobj = OBJECT(tcet);\n- char tmp[32];\n+ gchar *tmp;\n \n tcet->fd = -1;\n tcet->need_vfio = false;\n- snprintf(tmp, sizeof(tmp), \"tce-root-%x\", tcet->liobn);\n+ tmp = g_strdup_printf(\"tce-root-%x\", tcet->liobn);\n memory_region_init(&tcet->root, tcetobj, tmp, UINT64_MAX);\n+ g_free(tmp);\n \n- snprintf(tmp, sizeof(tmp), \"tce-iommu-%x\", tcet->liobn);\n+ tmp = g_strdup_printf(\"tce-iommu-%x\", tcet->liobn);\n memory_region_init_iommu(&tcet->iommu, sizeof(tcet->iommu),\n TYPE_SPAPR_IOMMU_MEMORY_REGION,\n tcetobj, tmp, 0);\n+ g_free(tmp);\n \n QLIST_INSERT_HEAD(&spapr_tce_tables, tcet, list);\n \n@@ -307,7 +309,7 @@ void spapr_tce_set_need_vfio(sPAPRTCETable *tcet, bool need_vfio)\n sPAPRTCETable *spapr_tce_new_table(DeviceState *owner, uint32_t liobn)\n {\n sPAPRTCETable *tcet;\n- char tmp[32];\n+ gchar *tmp;\n \n if (spapr_tce_find_by_liobn(liobn)) {\n error_report(\"Attempted to create TCE table with duplicate\"\n@@ -318,8 +320,9 @@ sPAPRTCETable *spapr_tce_new_table(DeviceState *owner, uint32_t liobn)\n tcet = SPAPR_TCE_TABLE(object_new(TYPE_SPAPR_TCE_TABLE));\n tcet->liobn = liobn;\n \n- snprintf(tmp, sizeof(tmp), \"tce-table-%x\", liobn);\n+ tmp = g_strdup_printf(\"tce-table-%x\", liobn);\n object_property_add_child(OBJECT(owner), tmp, OBJECT(tcet), NULL);\n+ g_free(tmp);\n \n object_property_set_bool(OBJECT(tcet), true, \"realized\", NULL);\n \n","prefixes":["PULL","05/40"]}