On 28/11/2018 09:53, Thomas Huth wrote: > On 2018-11-19 12:07, P J P wrote: >> From: Prasad J Pandit <p...@fedoraproject.org> >> >> The length parameter values are not negative, thus use an unsigned >> type 'size_t' for them. Many routines pass 'len' values to memcpy(3) >> calls. If it was negative, it could lead to memory corruption issues. >> Add check to avoid it. >> >> Reported-by: Arash TC <tohidi.ar...@gmail.com> >> Signed-off-by: Prasad J Pandit <p...@fedoraproject.org> >> --- >> bt-host.c | 8 +++--- >> bt-vhci.c | 7 +++--- >> hw/bt/core.c | 2 +- >> hw/bt/hci-csr.c | 32 ++++++++++++------------ >> hw/bt/hci.c | 38 ++++++++++++++-------------- >> hw/bt/hid.c | 10 ++++---- >> hw/bt/l2cap.c | 56 ++++++++++++++++++++++-------------------- >> hw/bt/sdp.c | 6 ++--- >> hw/usb/dev-bluetooth.c | 12 ++++----- >> include/hw/bt.h | 8 +++--- >> include/sysemu/bt.h | 10 ++++---- >> 11 files changed, 96 insertions(+), 93 deletions(-) >> >> Update v2: modify assert calls >> -> https://lists.gnu.org/archive/html/qemu-devel/2018-11/msg01036.html > > Reviewed-by: Thomas Huth <th...@redhat.com> > > Even though it's a rather big patch, I think the changes are trivial > enough so that it could go via qemu-trivial (now on CC:). If not, maybe > Paolo could take it through his "misc" tree?
I'll take this patch via qemu-trivial only if I get clearance from Paolo. BTW, I don't plan any qemu-trivial pull request before the final rc. Thanks, Laurent
