Series comparison

-[Qemu-devel] [PULL 0/1] Block patches
+[PULL 0/1] Block patches
-The following changes since commit 64175afc695c0672876fbbfc31b299c86d562cb4:
+The following changes since commit 41192db338588051f21501abc13743e62b0a5605:
-  arm_gicv3: Fix ICC_BPR1 reset value when EL3 not implemented (2017-06-07 17:21:44 +0100)
+  Merge remote-tracking branch 'remotes/ehabkost-gl/tags/machine-next-pull-request' into staging (2021-01-01 22:57:15 +0000)
-are available in the git repository at:
+are available in the Git repository at:
-  git://github.com/codyprime/qemu-kvm-jtc.git tags/block-pull-request
+  https://gitlab.com/stefanha/qemu.git tags/block-pull-request
-for you to fetch changes up to 56faeb9bb6872b3f926b3b3e0452a70beea10af2:
+for you to fetch changes up to 593621f36b716eb091c4ec791db72dd4461789da:
-  block/gluster.c: Handle qdict_array_entries() failure (2017-06-09 08:41:29 -0400)
+  readline: Fix possible array index out of bounds in readline_hist_add() (2021-01-04 11:13:39 +0000)
 ----------------------------------------------------------------
-Gluster patch
+Pull request
 ----------------------------------------------------------------
-Peter Maydell (1):
+Alex Chen (1):
-  block/gluster.c: Handle qdict_array_entries() failure
+  readline: Fix possible array index out of bounds in
     readline_hist_add()
- block/gluster.c | 3 +--
+ util/readline.c | 3 +++
-file changed, 1 insertion(+), 2 deletions(-)
+file changed, 3 insertions(+)
 --
-.9.3
+.29.2

-[Qemu-devel] [PULL 1/1] block/gluster.c: Handle qdict_array_entries() failure
+[PULL 1/1] readline: Fix possible array index out of bounds in readline_hist_add()
-From: Peter Maydell <peter.maydell@linaro.org>
+From: Alex Chen <alex.chen@huawei.com>
-In qemu_gluster_parse_json(), the call to qdict_array_entries()
+When the 'cmdline' is the last entry in 'rs->history' array, there is
-could return a negative error code, which we were ignoring
+no need to put this entry to the end of the array, partly because it is
-because we assigned the result to an unsigned variable.
+the last entry, and partly because the next operition will lead to array
-Fix this by using the 'int' type instead, which matches the
+index out of bounds.
 return type of qdict_array_entries() and also the type
 we use for the loop enumeration variable 'i'.
-(Spotted by Coverity, CID 1360960.)
+Reported-by: Euler Robot <euler.robot@huawei.com>
 Signed-off-by: Alex Chen <alex.chen@huawei.com>
 Message-id: 20201203135043.117072-1-alex.chen@huawei.com
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 ---
  util/readline.c | 3 +++
 file changed, 3 insertions(+)
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+diff --git a/util/readline.c b/util/readline.c
-Reviewed-by: Eric Blake <eblake@redhat.com>
+index XXXXXXX..XXXXXXX 100644
-Reviewed-by: Jeff Cody <jcody@redhat.com>
+--- a/util/readline.c
-Message-id: 1496682098-1540-1-git-send-email-peter.maydell@linaro.org
++++ b/util/readline.c
-Signed-off-by: Jeff Cody <jcody@redhat.com>
+@@ -XXX,XX +XXX,XX @@ static void readline_hist_add(ReadLineState *rs, const char *cmdline)
----
+         }
- block/gluster.c | 3 +--
+         if (strcmp(hist_entry, cmdline) == 0) {
-file changed, 1 insertion(+), 2 deletions(-)
+         same_entry:
 +            if (idx == READLINE_MAX_CMDS - 1) {
 +                return;
 +            }
              new_entry = hist_entry;
              /* Put this entry at the end of history */
              memmove(&rs->history[idx], &rs->history[idx + 1],
 --
 .29.2
-diff --git a/block/gluster.c b/block/gluster.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/gluster.c
-+++ b/block/gluster.c
-@@ -XXX,XX +XXX,XX @@ static int qemu_gluster_parse_json(BlockdevOptionsGluster *gconf,
-     Error *local_err = NULL;
-     char *str = NULL;
-     const char *ptr;
--    size_t num_servers;
--    int i, type;
-+    int i, type, num_servers;
-     /* create opts info from runtime_json_opts list */
-     opts = qemu_opts_create(&runtime_json_opts, NULL, 0, &error_abort);
---
-.9.3

From: Peter Maydell <peter.maydell@linaro.org>

In qemu_gluster_parse_json(), the call to qdict_array_entries()
could return a negative error code, which we were ignoring
because we assigned the result to an unsigned variable.
Fix this by using the 'int' type instead, which matches the
return type of qdict_array_entries() and also the type
we use for the loop enumeration variable 'i'.

(Spotted by Coverity, CID 1360960.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Jeff Cody <jcody@redhat.com>
Message-id: 1496682098-1540-1-git-send-email-peter.maydell@linaro.org
Signed-off-by: Jeff Cody <jcody@redhat.com>
---
 block/gluster.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/block/gluster.c b/block/gluster.c
index XXXXXXX..XXXXXXX 100644
--- a/block/gluster.c
+++ b/block/gluster.c
@@ -XXX,XX +XXX,XX @@ static int qemu_gluster_parse_json(BlockdevOptionsGluster *gconf,
     Error *local_err = NULL;
     char *str = NULL;
     const char *ptr;
-    size_t num_servers;
-    int i, type;
+    int i, type, num_servers;
 
     /* create opts info from runtime_json_opts list */
     opts = qemu_opts_create(&runtime_json_opts, NULL, 0, &error_abort);
-- 
2.9.3

From: Alex Chen <alex.chen@huawei.com>

When the 'cmdline' is the last entry in 'rs->history' array, there is
no need to put this entry to the end of the array, partly because it is
the last entry, and partly because the next operition will lead to array
index out of bounds.

Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Alex Chen <alex.chen@huawei.com>
Message-id: 20201203135043.117072-1-alex.chen@huawei.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 util/readline.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/util/readline.c b/util/readline.c
index XXXXXXX..XXXXXXX 100644
--- a/util/readline.c
+++ b/util/readline.c
@@ -XXX,XX +XXX,XX @@ static void readline_hist_add(ReadLineState *rs, const char *cmdline)
         }
         if (strcmp(hist_entry, cmdline) == 0) {
         same_entry:
+            if (idx == READLINE_MAX_CMDS - 1) {
+                return;
+            }
             new_entry = hist_entry;
             /* Put this entry at the end of history */
             memmove(&rs->history[idx], &rs->history[idx + 1],
-- 
2.29.2