From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:35071) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1adGdC-0008C1-A8 for qemu-devel@nongnu.org; Tue, 08 Mar 2016 07:20:55 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1adGd8-0007RB-6s for qemu-devel@nongnu.org; Tue, 08 Mar 2016 07:20:54 -0500 Received: from mx1.redhat.com ([209.132.183.28]:40637) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1adGd8-0007R5-0G for qemu-devel@nongnu.org; Tue, 08 Mar 2016 07:20:50 -0500 Received: from int-mx11.intmail.prod.int.phx2.redhat.com (int-mx11.intmail.prod.int.phx2.redhat.com [10.5.11.24]) by mx1.redhat.com (Postfix) with ESMTPS id 35625627CB for ; Tue, 8 Mar 2016 12:20:49 +0000 (UTC) References: <1457420446-25276-1-git-send-email-peterx@redhat.com> <1457420446-25276-4-git-send-email-peterx@redhat.com> From: Paolo Bonzini Message-ID: <56DEC39D.2050006@redhat.com> Date: Tue, 8 Mar 2016 13:20:45 +0100 MIME-Version: 1.0 In-Reply-To: <1457420446-25276-4-git-send-email-peterx@redhat.com> Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] [PATCH 3/8] usb: fix unbounded stack for ohci_td_pkt List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Peter Xu , qemu-devel@nongnu.org Cc: Gerd Hoffmann On 08/03/2016 08:00, Peter Xu wrote: > Suggested-by: Paolo Bonzini > CC: Gerd Hoffmann > Signed-off-by: Peter Xu > --- > hw/usb/hcd-ohci.c | 7 ++++--- > 1 file changed, 4 insertions(+), 3 deletions(-) > > diff --git a/hw/usb/hcd-ohci.c b/hw/usb/hcd-ohci.c > index 17ed461..c3cd4e2 100644 > --- a/hw/usb/hcd-ohci.c > +++ b/hw/usb/hcd-ohci.c > @@ -936,11 +936,11 @@ static int ohci_service_iso_td(OHCIState *ohci, struct ohci_ed *ed, > #ifdef trace_event_get_state > static void ohci_td_pkt(const char *msg, const uint8_t *buf, size_t len) > { > +#define __TEMP_WIDTH (16) > bool print16 = !!trace_event_get_state(TRACE_USB_OHCI_TD_PKT_SHORT); > bool printall = !!trace_event_get_state(TRACE_USB_OHCI_TD_PKT_FULL); > - const int width = 16; > int i; > - char tmp[3 * width + 1]; > + char tmp[3 * __TEMP_WIDTH + 1]; > char *p = tmp; > > if (!printall && !print16) { > @@ -948,7 +948,7 @@ static void ohci_td_pkt(const char *msg, const uint8_t *buf, size_t len) > } > > for (i = 0; ; i++) { > - if (i && (!(i % width) || (i == len))) { > + if (i && (!(i % __TEMP_WIDTH) || (i == len))) { > if (!printall) { > trace_usb_ohci_td_pkt_short(msg, tmp); > break; > @@ -963,6 +963,7 @@ static void ohci_td_pkt(const char *msg, const uint8_t *buf, size_t len) > > p += sprintf(p, " %.2x", buf[i]); > } > +#undef __TEMP_WIDTH > } > #else > static void ohci_td_pkt(const char *msg, const uint8_t *buf, size_t len) > This is a compiler false positive. You can change "i % width" to p - tmp == ARRAY_SIZE(tmp) - 1 if you want to avoid it, but I'd just ignore this one. Paolo