Re: [Qemu-devel] [PATCH v2] bt: use size_t type for length parameters instead of int

[Thomas Huth <thuth@redhat.com>]

On 2018-11-19 12:07, P J P wrote:
> From: Prasad J Pandit <pjp@fedoraproject.org>
> 
> The length parameter values are not negative, thus use an unsigned
> type 'size_t' for them. Many routines pass 'len' values to memcpy(3)
> calls. If it was negative, it could lead to memory corruption issues.
> Add check to avoid it.
> 
> Reported-by: Arash TC <tohidi.arash@gmail.com>
> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
> ---
>  bt-host.c              |  8 +++---
>  bt-vhci.c              |  7 +++---
>  hw/bt/core.c           |  2 +-
>  hw/bt/hci-csr.c        | 32 ++++++++++++------------
>  hw/bt/hci.c            | 38 ++++++++++++++--------------
>  hw/bt/hid.c            | 10 ++++----
>  hw/bt/l2cap.c          | 56 ++++++++++++++++++++++--------------------
>  hw/bt/sdp.c            |  6 ++---
>  hw/usb/dev-bluetooth.c | 12 ++++-----
>  include/hw/bt.h        |  8 +++---
>  include/sysemu/bt.h    | 10 ++++----
>  11 files changed, 96 insertions(+), 93 deletions(-)
> 
> Update v2: modify assert calls
>   -> https://lists.gnu.org/archive/html/qemu-devel/2018-11/msg01036.html

Reviewed-by: Thomas Huth <thuth@redhat.com>

Even though it's a rather big patch, I think the changes are trivial
enough so that it could go via qemu-trivial (now on CC:). If not, maybe
Paolo could take it through his "misc" tree?

 Thomas