[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 02/22] scsi: Silence gcc warning
From: |
Laurent Vivier |
Subject: |
[PULL 02/22] scsi: Silence gcc warning |
Date: |
Wed, 10 Mar 2021 22:44:44 +0100 |
From: Eric Blake <eblake@redhat.com>
On Fedora 33, gcc 10.2.1 notes that scsi_cdb_length(buf) can set
len==-1, which in turn overflows g_malloc():
[5/5] Linking target qemu-system-x86_64
In function ‘scsi_disk_new_request_dump’,
inlined from ‘scsi_new_request’ at ../hw/scsi/scsi-disk.c:2608:9:
../hw/scsi/scsi-disk.c:2582:19: warning: argument 1 value
‘18446744073709551612’ exceeds maximum object size 9223372036854775807
[-Walloc-size-larger-than=]
2582 | line_buffer = g_malloc(len * 5 + 1);
| ^
Silence it with a decent assertion, since we only convert a buffer to
bytes when we have a valid cdb length.
Signed-off-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-Id: <20210209152350.207958-1-eblake@redhat.com>
Signed-off-by: Laurent Vivier <laurent@vivier.eu>
---
hw/scsi/scsi-disk.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c
index bd7103cd0e8a..2eaea7e637d8 100644
--- a/hw/scsi/scsi-disk.c
+++ b/hw/scsi/scsi-disk.c
@@ -2565,6 +2565,7 @@ static void scsi_disk_new_request_dump(uint32_t lun,
uint32_t tag, uint8_t *buf)
int len = scsi_cdb_length(buf);
char *line_buffer, *p;
+ assert(len > 0 && len <= 16);
line_buffer = g_malloc(len * 5 + 1);
for (i = 0, p = line_buffer; i < len; i++) {
--
2.29.2
- [PULL 00/22] Trivial branch for 6.0 patches, Laurent Vivier, 2021/03/10
- [PULL 03/22] hw/elf_ops: Fix a typo, Laurent Vivier, 2021/03/10
- [PULL 01/22] Various spelling fixes, Laurent Vivier, 2021/03/10
- [PULL 07/22] MAINTAINERS: Fix the location of tools manuals, Laurent Vivier, 2021/03/10
- [PULL 02/22] scsi: Silence gcc warning,
Laurent Vivier <=
- [PULL 06/22] vhost_user_gpu: Drop dead check for g_malloc() failure, Laurent Vivier, 2021/03/10
- [PULL 05/22] backends/dbus-vmstate: Fix short read error handling, Laurent Vivier, 2021/03/10
- [PULL 08/22] net: Use id_generate() in the network subsystem, too, Laurent Vivier, 2021/03/10
- [PULL 09/22] fuzz-test: remove unneccessary debugging flags, Laurent Vivier, 2021/03/10
- [PULL 10/22] exec/memory: Use struct Object typedef, Laurent Vivier, 2021/03/10
- [PULL 11/22] virtio-gpu: Adjust code space style, Laurent Vivier, 2021/03/10
- [PULL 04/22] target/hexagon/gen_tcg_funcs: Fix a typo, Laurent Vivier, 2021/03/10
- [PULL 12/22] ui: Replace the word 'whitelist', Laurent Vivier, 2021/03/10
- [PULL 18/22] hw/lm32/Kconfig: Introduce CONFIG_LM32_EVR for lm32-evr/uclinux boards, Laurent Vivier, 2021/03/10
- [PULL 14/22] seccomp: Replace the word 'blacklist', Laurent Vivier, 2021/03/10