On 2018-11-19 12:07, P J P wrote: > From: Prasad J Pandit <p...@fedoraproject.org> > > The length parameter values are not negative, thus use an unsigned > type 'size_t' for them. Many routines pass 'len' values to memcpy(3) > calls. If it was negative, it could lead to memory corruption issues. > Add check to avoid it. > > Reported-by: Arash TC <tohidi.ar...@gmail.com> > Signed-off-by: Prasad J Pandit <p...@fedoraproject.org> > --- > bt-host.c | 8 +++--- > bt-vhci.c | 7 +++--- > hw/bt/core.c | 2 +- > hw/bt/hci-csr.c | 32 ++++++++++++------------ > hw/bt/hci.c | 38 ++++++++++++++-------------- > hw/bt/hid.c | 10 ++++---- > hw/bt/l2cap.c | 56 ++++++++++++++++++++++-------------------- > hw/bt/sdp.c | 6 ++--- > hw/usb/dev-bluetooth.c | 12 ++++----- > include/hw/bt.h | 8 +++--- > include/sysemu/bt.h | 10 ++++---- > 11 files changed, 96 insertions(+), 93 deletions(-) > > Update v2: modify assert calls > -> https://lists.gnu.org/archive/html/qemu-devel/2018-11/msg01036.html
Reviewed-by: Thomas Huth <th...@redhat.com> Even though it's a rather big patch, I think the changes are trivial enough so that it could go via qemu-trivial (now on CC:). If not, maybe Paolo could take it through his "misc" tree? Thomas
