Re: [Qemu-devel] [Qemu-trivial] [PATCH v1] bt: use size_t type for length parameters instead of int

[Laurent Vivier <lvivier@redhat.com>]

On 06/11/2018 15:52, Thomas Huth wrote:
> On 2018-11-02 10:05, P J P wrote:
>> +-- On Sat, 27 Oct 2018, P J P wrote --+
>> |+-- On Sun, 21 Oct 2018, P J P wrote --+
>> || The length parameter values are not negative, thus use an unsigned
>> || type 'size_t' for them. Many routines pass 'len' values to memcpy(3)
>> || calls. If it was negative, it could lead to memory corruption issues.
>> || Add check to avoid it.
>> || 
>> || Reported-by: Arash TC <tohidi.arash@gmail.com>
>> || Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
>> || ---
>> ||  bt-host.c              |  8 +++---
>> ||  bt-vhci.c              |  7 +++---
>> ||  hw/bt/core.c           |  2 +-
>> ||  hw/bt/hci-csr.c        | 20 +++++++--------
>> ||  hw/bt/hci.c            | 38 ++++++++++++++--------------
>> ||  hw/bt/hid.c            | 10 ++++----
>> ||  hw/bt/l2cap.c          | 56 ++++++++++++++++++++++--------------------
>> ||  hw/bt/sdp.c            |  6 ++---
>> ||  hw/usb/dev-bluetooth.c | 12 ++++-----
>> ||  include/hw/bt.h        |  8 +++---
>> ||  include/sysemu/bt.h    | 10 ++++----
>> ||  11 files changed, 90 insertions(+), 87 deletions(-)
>> || 
>> || Update v1: add assert check in vhci_host_send. Also check other places wherein
>> || length is used with fixed size buffers.
>> ||   -> https://lists.gnu.org/archive/html/qemu-devel/2018-10/msg03831.html
>> | 
>> | Ping...!
>>
>> Ping...!
> 
> The bluetooth subsystem is completely unmaintained, so if Paolo does not
> want to pick it up through his "misc" tree, maybe Peter could apply this
> patch directly? Or maybe it could go through the trivial tree since it
> does not look very complicated?
> 
> FWIW, the patch looks OK to me at a first glance, so:
> 
> Acked-by: Thomas Huth <thuth@redhat.com>
> 
> PS: I still think we should deprecate the bt subsystem, since nobody
> really touched it within years...
> 

I can add it to the trivial-patches branch, but I don't plan any pull
request before the 3.1 release in December.

Thanks,
Laurent