Re: [Qemu-devel] [PATCH v3 04/46] ivshmem: fix number of bytes to push to fifo

[Claudio Fontana]

On 15.09.2015 18:07, address@hidden wrote:
> From: Marc-André Lureau <address@hidden>
> 
> If the fifo has 0 bytes, and the read is of size 1, the call to
> fifo8_push_all() will copy off boundary data.
> 
> Signed-off-by: Marc-André Lureau <address@hidden>
> ---
>  hw/misc/ivshmem.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/hw/misc/ivshmem.c b/hw/misc/ivshmem.c
> index fb53b3f..2162d02 100644
> --- a/hw/misc/ivshmem.c
> +++ b/hw/misc/ivshmem.c
> @@ -455,7 +455,7 @@ static void ivshmem_read(void *opaque, const uint8_t 
> *buf, int size)
>          uint32_t num;
>  
>          IVSHMEM_DPRINTF("short read of %d bytes\n", size);
> -        num = MAX(size, sizeof(long) - fifo8_num_used(&s->incoming_fifo));
> +        num = MIN(size, sizeof(long) - fifo8_num_used(&s->incoming_fifo));
>          fifo8_push_all(&s->incoming_fifo, buf, num);
>          if (fifo8_num_used(&s->incoming_fifo) < sizeof(incoming_posn)) {
>              return;
> 

(should we rely on sizeof(long) here?)

Ciao,

Claudio