Re: [Qemu-devel] [PATCH v6 5/7] hw/core: rebase sysbus_get_fw_dev_path() to g_strdup_printf()

[Laszlo Ersek <lersek@redhat.com>]

On 06/17/15 15:46, Michael S. Tsirkin wrote:
> On Wed, Jun 17, 2015 at 02:45:03PM +0200, Laszlo Ersek wrote:
>> This is done mainly for improving readability, and in preparation for the
>> next patch, but Markus pointed out another bonus for the string being
>> returned:
>>
>> "No arbitrary length limit. Before the patch, it's 39 characters, and the
>> code breaks catastrophically when qdev_fw_name() is longer: the second
>> snprintf() is called with its first argument pointing beyond path[], and
>> its second argument underflowing to a huge size."
>>
>> Cc: Markus Armbruster <armbru@redhat.com>
>> Cc: Marcel Apfelbaum <marcel@redhat.com>
>> Cc: Michael S. Tsirkin <mst@redhat.com>
>> Signed-off-by: Laszlo Ersek <lersek@redhat.com>
>> Tested-by: Marcel Apfelbaum <marcel@redhat.com>
>> Reviewed-by: Marcel Apfelbaum <marcel@redhat.com>
>> Reviewed-by: Markus Armbruster <armbru@redhat.com>
> 
> Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
> 
> In fact, I'd Cc stable on this one.

Will do, thanks.

Laszlo

> 
>> ---
>>
>> Notes:
>>     v6:
>>     - no changes
>>     
>>     v5:
>>     - separate "%s@" from TARGET_FMT_plx with a space [Markus]
>>     - copied Markus's note about "no arbitrary length limit" on the retval
>>       into the commit message
>>     
>>     v4:
>>     - unchanged
>>     
>>     v3:
>>     - new in v3
>>
>>  hw/core/sysbus.c | 16 ++++++----------
>>  1 file changed, 6 insertions(+), 10 deletions(-)
>>
>> diff --git a/hw/core/sysbus.c b/hw/core/sysbus.c
>> index b53c351..92eced9 100644
>> --- a/hw/core/sysbus.c
>> +++ b/hw/core/sysbus.c
>> @@ -281,19 +281,15 @@ static void sysbus_dev_print(Monitor *mon, DeviceState *dev, int indent)
>>  static char *sysbus_get_fw_dev_path(DeviceState *dev)
>>  {
>>      SysBusDevice *s = SYS_BUS_DEVICE(dev);
>> -    char path[40];
>> -    int off;
>> -
>> -    off = snprintf(path, sizeof(path), "%s", qdev_fw_name(dev));
>>  
>>      if (s->num_mmio) {
>> -        snprintf(path + off, sizeof(path) - off, "@"TARGET_FMT_plx,
>> -                 s->mmio[0].addr);
>> -    } else if (s->num_pio) {
>> -        snprintf(path + off, sizeof(path) - off, "@i%04x", s->pio[0]);
>> +        return g_strdup_printf("%s@" TARGET_FMT_plx, qdev_fw_name(dev),
>> +                               s->mmio[0].addr);
>>      }
>> -
>> -    return g_strdup(path);
>> +    if (s->num_pio) {
>> +        return g_strdup_printf("%s@i%04x", qdev_fw_name(dev), s->pio[0]);
>> +    }
>> +    return g_strdup(qdev_fw_name(dev));
>>  }
>>  
>>  void sysbus_add_io(SysBusDevice *dev, hwaddr addr,
>> -- 
>> 1.8.3.1
>>