From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([140.186.70.92]:34191)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <peter.maydell@linaro.org>) id 1RGDVB-0001vH-U1
	for qemu-devel@nongnu.org; Tue, 18 Oct 2011 13:31:01 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <peter.maydell@linaro.org>) id 1RGDVA-0001jO-Ap
	for qemu-devel@nongnu.org; Tue, 18 Oct 2011 13:30:57 -0400
MIME-Version: 1.0
In-Reply-To: <1318958208-13965-1-git-send-email-pavel.borzenkov@gmail.com>
References: <1318958208-13965-1-git-send-email-pavel.borzenkov@gmail.com>
Date: Tue, 18 Oct 2011 18:30:54 +0100
Message-ID: <CAFEAcA_SBfk9Rhthr6_sX-d3H1bkbUexmynucZZSmCVPVJgwpw@mail.gmail.com>
From: Peter Maydell <peter.maydell@linaro.org>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [Qemu-devel] [PATCH] fw_cfg: check return value of fread()
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: Pavel Borzenkov <pavel.borzenkov@gmail.com>
Cc: qemu-trivial@nongnu.org, qemu-devel@nongnu.org

On 18 October 2011 18:16, Pavel Borzenkov <pavel.borzenkov@gmail.com> wrote=
:
> Spotted by Clang Analyzer
>
> Signed-off-by: Pavel Borzenkov <pavel.borzenkov@gmail.com>
> ---
> =C2=A0hw/fw_cfg.c | =C2=A0 =C2=A07 +++++++
> =C2=A01 files changed, 7 insertions(+), 0 deletions(-)
>
> diff --git a/hw/fw_cfg.c b/hw/fw_cfg.c
> index 8df265c..1125e7d 100644
> --- a/hw/fw_cfg.c
> +++ b/hw/fw_cfg.c
> @@ -113,6 +113,13 @@ static FILE *probe_splashfile(char *filename, int *f=
ile_sizep, int *file_typep)
> =C2=A0 =C2=A0 if (file_type =3D=3D BMP_FILE) {
> =C2=A0 =C2=A0 =C2=A0 =C2=A0 fseek(fp, 28, SEEK_SET);
> =C2=A0 =C2=A0 =C2=A0 =C2=A0 fop_ret =3D fread(buf, 1, 2, fp);
> + =C2=A0 =C2=A0 =C2=A0 =C2=A0if (fop_ret !=3D 2) {
> + =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0error_report("Could not read b=
pp value from '%s': %s",
> + =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 filename, strerror(errno));
> + =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0fclose(fp);
> + =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0fp =3D NULL;
> + =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0return fp;
> + =C2=A0 =C2=A0 =C2=A0 =C2=A0}
> =C2=A0 =C2=A0 =C2=A0 =C2=A0 bmp_bpp =3D (buf[0] + (buf[1] << 8)) & 0xffff=
;
> =C2=A0 =C2=A0 =C2=A0 =C2=A0 if (bmp_bpp !=3D 24) {
> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 error_report("only 24bpp bmp fi=
le is supported.");

Yuck, this code again. We should just replace it with
g_file_get_contents() and looking at the resulting buffer.
That would be 10% of the code and much less bug-ridden.

FWIW, strictly speaking there isn't a need to check the result
of the fread() because if we don't read the data then buf[] will
still have the BMP_FILE signature in it and the !=3D 24 check will
fail.

Not checking the return code from that fseek(), on the other hand...

-- PMM