Re: [Qemu-devel] [PATCH 1/2] qdev: factor out qdev_print_devinfo.

[Markus Armbruster]

Gerd Hoffmann <address@hidden> writes:

> Signed-off-by: Gerd Hoffmann <address@hidden>
> ---
>  hw/qdev.c |   19 ++++++++++++++++++-
>  1 files changed, 18 insertions(+), 1 deletions(-)
>
> diff --git a/hw/qdev.c b/hw/qdev.c
> index 479eb72..6f05232 100644
> --- a/hw/qdev.c
> +++ b/hw/qdev.c
> @@ -105,6 +105,21 @@ DeviceState *qdev_create(BusState *bus, const char *name)
>      return dev;
>  }
>  
> +static int qdev_print_devinfo(DeviceInfo *info, char *dest, int len)
> +{
> +    int pos = 0;
> +
> +    pos += snprintf(dest+pos, len-pos, "name \"%s\", bus %s",
> +                    info->name, info->bus_info->name);
> +    if (info->alias)
> +        pos += snprintf(dest+pos, len-pos, ", alias \"%s\"", info->alias);
> +    if (info->desc)
> +        pos += snprintf(dest+pos, len-pos, ", desc \"%s\"", info->desc);
> +    if (info->no_user)
> +        pos += snprintf(dest+pos, len-pos, ", no-user");
> +    return pos;
> +}
> +

Isn't len-pos vulnerable to underflow here?  The formal parameter type
is size_t...

[...]