From nobody Wed Nov 5 02:11:39 2025 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1501005914235961.7903340262261; Tue, 25 Jul 2017 11:05:14 -0700 (PDT) Received: from localhost ([::1]:33902 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1da4Ck-00060P-FJ for importer@patchew.org; Tue, 25 Jul 2017 14:05:10 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:56660) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1da46f-0000lz-3t for qemu-devel@nongnu.org; Tue, 25 Jul 2017 13:58:53 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1da46c-0000xT-2r for qemu-devel@nongnu.org; Tue, 25 Jul 2017 13:58:53 -0400 Received: from 12.mo5.mail-out.ovh.net ([46.105.39.65]:44076) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1da46b-0000wX-SG for qemu-devel@nongnu.org; Tue, 25 Jul 2017 13:58:50 -0400 Received: from player760.ha.ovh.net (b6.ovh.net [213.186.33.56]) by mo5.mail-out.ovh.net (Postfix) with ESMTP id 6CD7711641C for ; Tue, 25 Jul 2017 19:58:48 +0200 (CEST) Received: from [192.168.0.243] (gar31-1-82-66-74-139.fbx.proxad.net [82.66.74.139]) (Authenticated sender: groug@kaod.org) by player760.ha.ovh.net (Postfix) with ESMTPA id 06E9F20077; Tue, 25 Jul 2017 19:58:40 +0200 (CEST) From: Greg Kurz To: qemu-devel@nongnu.org Date: Tue, 25 Jul 2017 19:58:40 +0200 Message-ID: <150100552078.27487.390170136970607382.stgit@bahia> In-Reply-To: <150100547373.27487.3154210751350595400.stgit@bahia> References: <150100547373.27487.3154210751350595400.stgit@bahia> User-Agent: StGit/0.17.1-20-gc0b1b-dirty MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Ovh-Tracer-Id: 9716516197364505049 X-VR-SPAMSTATE: OK X-VR-SPAMSCORE: -100 X-VR-SPAMCAUSE: gggruggvucftvghtrhhoucdtuddrfeelkedrheehgdduvddtucetufdoteggodetrfdotffvucfrrhhofhhilhgvmecuqfggjfdpvefjgfevmfevgfenuceurghilhhouhhtmecufedttdenucesvcftvggtihhpihgvnhhtshculddquddttddm X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 46.105.39.65 Subject: [Qemu-devel] [for-2.11 PATCH 03/26] spapr_iommu: use g_strdup_printf() instead of snprintf() X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: "Michael S. Tsirkin" , Michael Roth , qemu-ppc@nongnu.org, Bharata B Rao , Paolo Bonzini , Daniel Henrique Barboza , David Gibson Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 Passing a stack allocated buffer of arbitrary length to snprintf() without checking the return value can cause the resultant strings to be silently truncated. Signed-off-by: Greg Kurz --- hw/ppc/spapr_iommu.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/hw/ppc/spapr_iommu.c b/hw/ppc/spapr_iommu.c index e614621a8317..740d42608b61 100644 --- a/hw/ppc/spapr_iommu.c +++ b/hw/ppc/spapr_iommu.c @@ -252,17 +252,19 @@ static int spapr_tce_table_realize(DeviceState *dev) { sPAPRTCETable *tcet =3D SPAPR_TCE_TABLE(dev); Object *tcetobj =3D OBJECT(tcet); - char tmp[32]; + gchar *tmp; =20 tcet->fd =3D -1; tcet->need_vfio =3D false; - snprintf(tmp, sizeof(tmp), "tce-root-%x", tcet->liobn); + tmp =3D g_strdup_printf("tce-root-%x", tcet->liobn); memory_region_init(&tcet->root, tcetobj, tmp, UINT64_MAX); + g_free(tmp); =20 - snprintf(tmp, sizeof(tmp), "tce-iommu-%x", tcet->liobn); + tmp =3D g_strdup_printf("tce-iommu-%x", tcet->liobn); memory_region_init_iommu(&tcet->iommu, sizeof(tcet->iommu), TYPE_SPAPR_IOMMU_MEMORY_REGION, tcetobj, tmp, 0); + g_free(tmp); =20 QLIST_INSERT_HEAD(&spapr_tce_tables, tcet, list); =20 @@ -307,7 +309,7 @@ void spapr_tce_set_need_vfio(sPAPRTCETable *tcet, bool = need_vfio) sPAPRTCETable *spapr_tce_new_table(DeviceState *owner, uint32_t liobn) { sPAPRTCETable *tcet; - char tmp[32]; + gchar *tmp; =20 if (spapr_tce_find_by_liobn(liobn)) { error_report("Attempted to create TCE table with duplicate" @@ -318,8 +320,9 @@ sPAPRTCETable *spapr_tce_new_table(DeviceState *owner, = uint32_t liobn) tcet =3D SPAPR_TCE_TABLE(object_new(TYPE_SPAPR_TCE_TABLE)); tcet->liobn =3D liobn; =20 - snprintf(tmp, sizeof(tmp), "tce-table-%x", liobn); + tmp =3D g_strdup_printf("tce-table-%x", liobn); object_property_add_child(OBJECT(owner), tmp, OBJECT(tcet), NULL); + g_free(tmp); =20 object_property_set_bool(OBJECT(tcet), true, "realized", NULL); =20