From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1Kg3D0-0001WZ-11 for qemu-devel@nongnu.org; Wed, 17 Sep 2008 16:01:06 -0400 Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43) id 1Kg3Cx-0001Vs-IX for qemu-devel@nongnu.org; Wed, 17 Sep 2008 16:01:04 -0400 Received: from [199.232.76.173] (port=43695 helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1Kg3Cx-0001Vo-CE for qemu-devel@nongnu.org; Wed, 17 Sep 2008 16:01:03 -0400 Received: from toccata.ens-lyon.org ([140.77.166.68]:40460) by monty-python.gnu.org with esmtps (TLS-1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.60) (envelope-from ) id 1Kg3Cx-0002iq-5X for qemu-devel@nongnu.org; Wed, 17 Sep 2008 16:01:03 -0400 Received: from localhost (localhost [127.0.0.1]) by toccata.ens-lyon.org (Postfix) with ESMTP id F105684087 for ; Wed, 17 Sep 2008 22:00:59 +0200 (CEST) Received: from toccata.ens-lyon.org ([127.0.0.1]) by localhost (toccata.ens-lyon.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zLhRx0YuhqpK for ; Wed, 17 Sep 2008 22:00:59 +0200 (CEST) Received: from implementation.famille.thibault.fr (251.135.100-84.rev.gaoland.net [84.100.135.251]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by toccata.ens-lyon.org (Postfix) with ESMTP id ACE1584080 for ; Wed, 17 Sep 2008 22:00:59 +0200 (CEST) Received: from samy by implementation.famille.thibault.fr with local (Exim 4.69) (envelope-from ) id 1Kg3Cw-0001sw-Vu for qemu-devel@nongnu.org; Wed, 17 Sep 2008 22:01:02 +0200 Date: Wed, 17 Sep 2008 22:01:02 +0200 From: Samuel Thibault Subject: Re: [Qemu-devel] [PATCH] usb-serial: Fix memory overruns with usb serial emulation Message-ID: <20080917200102.GB4204@implementation> References: <48D08F06.2070905@windriver.com> <200809171118.42802.paul@codesourcery.com> <200809171138.01465.paul@codesourcery.com> <48D0F007.1070903@windriver.com> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline In-Reply-To: <48D0F007.1070903@windriver.com> Content-Transfer-Encoding: quoted-printable Reply-To: qemu-devel@nongnu.org List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Jason Wessel, le Wed 17 Sep 2008 06:54:47 -0500, a =E9crit : > * Remove the unused send_buf variable and its constant. >=20 > * Fix a math error > The variables recv_ptr and recv_used are not large enough to hold > the constant 384, which causes data corruption when the pointer is > reset with: s->recv_ptr =3D (s->recv_ptr + len) % RECV_BUF; >=20 > Signed-off-by: Jason Wessel Acked-by: Samuel Thibault Samuel