gcc 7 is pickier about our sources:

hw/usb/bus.c: In function ‘usb_port_location’:
hw/usb/bus.c:410:66: error: ‘%d’ directive output may be truncated writing between 1 and 11 bytes into a region of size between 0 and 15 [-Werror=format-truncation=]
         snprintf(downstream->path, sizeof(downstream->path), "%s.%d",
                                                                  ^~
hw/usb/bus.c:410:9: note: ‘snprintf’ output between 3 and 28 bytes into a destination of size 16
         snprintf(downstream->path, sizeof(downstream->path), "%s.%d",
         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                  upstream->path, portnr);
                  ~~~~~~~~~~~~~~~~~~~~~~~

But we know that there are at most 5 levels of USB hubs, with at
most two digits per level; that plus the separating dots means we
use at most 15 bytes (including trailing NUL) of our 16-byte field.
Adding an assertion to show gcc that we checked for truncation is
enough to shut up the false-positive warning.

Inspired by an idea by Dr. David Alan Gilbert <dgilbert@redhat.com>.

Signed-off-by: Eric Blake <eblake@redhat.com>
---
 hw/usb/bus.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/hw/usb/bus.c b/hw/usb/bus.c
index 5939b273b9..d910f849e7 100644
--- a/hw/usb/bus.c
+++ b/hw/usb/bus.c
@@ -407,8 +407,10 @@ void usb_register_companion(const char *masterbus, USBPort *ports[],
 void usb_port_location(USBPort *downstream, USBPort *upstream, int portnr)
 {
     if (upstream) {
-        snprintf(downstream->path, sizeof(downstream->path), "%s.%d",
-                 upstream->path, portnr);
+        int l = snprintf(downstream->path, sizeof(downstream->path), "%s.%d",
+                         upstream->path, portnr);
+        /* Max string is nn.nn.nn.nn.nn, which fits in 16 bytes */
+        assert(l < sizeof(downstream->path));
         downstream->hubcount = upstream->hubcount + 1;
     } else {
         snprintf(downstream->path, sizeof(downstream->path), "%d", portnr);
-- 
2.13.3

On 07/17/2017 12:13 PM, Eric Blake wrote:
> gcc 7 is pickier about our sources:
> 
> hw/usb/bus.c: In function ‘usb_port_location’:
> hw/usb/bus.c:410:66: error: ‘%d’ directive output may be truncated writing between 1 and 11 bytes into a region of size between 0 and 15 [-Werror=format-truncation=]
>           snprintf(downstream->path, sizeof(downstream->path), "%s.%d",
>                                                                    ^~
> hw/usb/bus.c:410:9: note: ‘snprintf’ output between 3 and 28 bytes into a destination of size 16
>           snprintf(downstream->path, sizeof(downstream->path), "%s.%d",
>           ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>                    upstream->path, portnr);
>                    ~~~~~~~~~~~~~~~~~~~~~~~
> 
> But we know that there are at most 5 levels of USB hubs, with at
> most two digits per level; that plus the separating dots means we
> use at most 15 bytes (including trailing NUL) of our 16-byte field.
> Adding an assertion to show gcc that we checked for truncation is
> enough to shut up the false-positive warning.
> 
> Inspired by an idea by Dr. David Alan Gilbert <dgilbert@redhat.com>.

elegant :)

> 
> Signed-off-by: Eric Blake <eblake@redhat.com>

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

> ---
>   hw/usb/bus.c | 6 ++++--
>   1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/hw/usb/bus.c b/hw/usb/bus.c
> index 5939b273b9..d910f849e7 100644
> --- a/hw/usb/bus.c
> +++ b/hw/usb/bus.c
> @@ -407,8 +407,10 @@ void usb_register_companion(const char *masterbus, USBPort *ports[],
>   void usb_port_location(USBPort *downstream, USBPort *upstream, int portnr)
>   {
>       if (upstream) {
> -        snprintf(downstream->path, sizeof(downstream->path), "%s.%d",
> -                 upstream->path, portnr);
> +        int l = snprintf(downstream->path, sizeof(downstream->path), "%s.%d",
> +                         upstream->path, portnr);
> +        /* Max string is nn.nn.nn.nn.nn, which fits in 16 bytes */
> +        assert(l < sizeof(downstream->path));
>           downstream->hubcount = upstream->hubcount + 1;
>       } else {
>           snprintf(downstream->path, sizeof(downstream->path), "%d", portnr);
>