Re: [Qemu-devel] [PATCH v2] bt: use size_t type for length parameters instead of int

[Hugo Lefeuvre]

Hi,

> The length parameter values are not negative, thus use an unsigned
> type 'size_t' for them. Many routines pass 'len' values to memcpy(3)
> calls. If it was negative, it could lead to memory corruption issues.
> Add check to avoid it.

I'm working on a Debian LTS security update for qemu and am currently
thinking about addressing this issue as well.

I see this patch has not been applied yet and the bluetooth subsystem
is pending deprecation. Are you still considering to apply it?

> @@ -113,6 +113,7 @@ static void vhci_host_send(void *opaque,
>      static uint8_t buf[4096];
>  
>      buf[0] = type;
> +    assert(len < sizeof(buf));
>      memcpy(buf + 1, data, len);
>  
>      while (write(s->fd, buf, len + 1) < 0)

Any reason why assert() calls are used here ?

These checks should always be executed, but they won't if user compiles
without asserts. Also, AFAIK any assert failure will stop the qemu host
process which is not what we want in this case.

regards,
 Hugo

-- 
                Hugo Lefeuvre (hle)    |    www.owl.eu.com
RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A247 3DFD
ed25519_ 37B2 6D38 0B25 B8A2 6B9F 3A65 A36F 5357 5F2D DC4C

signature.asc
Description: PGP signature