Build problems in kdd.c with xen-4.14.0-rc4

From: Michael Young <m.a.young@durham.ac.uk>
To: xen-devel@lists.xenproject.org
Cc: Tim Deegan <tim@xen.org>
Subject: Build problems in kdd.c with xen-4.14.0-rc4
Date: Tue, 30 Jun 2020 23:21:36 +0100 (BST)	[thread overview]
Message-ID: <alpine.LFD.2.22.394.2006302259370.2894@austen3.home> (raw)

I get the following errors when trying to build xen-4.14.0-rc4

kdd.c: In function 'kdd_tx':
kdd.c:754:15: error: array subscript 16 is above array bounds of 'uint8_t[16]' {aka 'unsigned char[16]'} [-Werror=array-bounds]
   754 |         s->txb[len++] = 0xaa;
       |         ~~~~~~^~~~~~~
kdd.c:82:17: note: while referencing 'txb'
    82 |         uint8_t txb[sizeof (kdd_hdr)];           /* Marshalling area for tx */
       |                 ^~~
kdd.c: In function 'kdd_break':
kdd.c:819:19: error: array subscript 16 is above array bounds of 'uint8_t[16]' {aka 'unsigned char[16]'} [-Werror=array-bounds]
   819 |             s->txb[sizeof (kdd_hdr) + i] = i;
       |             ~~~~~~^~~~~~~~~~~~~~~~~~~~~~
kdd.c:82:17: note: while referencing 'txb'
    82 |         uint8_t txb[sizeof (kdd_hdr)];           /* Marshalling area for tx */
       |                 ^~~
In file included from /usr/include/stdio.h:867,
                  from kdd.c:36:
In function 'vsnprintf',
     inlined from 'kdd_send_string' at kdd.c:791:11:
/usr/include/bits/stdio2.h:80:10: error: '__builtin___vsnprintf_chk' specified bound 65519 exceeds destination size 0 [-Werror=stringop-overflow=]
    80 |   return __builtin___vsnprintf_chk (__s, __n, __USE_FORTIFY_LEVEL - 1,
       |          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    81 |         __bos (__s), __fmt, __ap);
       |         ~~~~~~~~~~~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
make[4]: *** [/builddir/build/BUILD/xen-4.14.0-rc4/tools/debugger/kdd/../../../tools/Rules.mk:216: kdd.o] Error 1

The first two array-bounds errors seem to be a result of the

kdd: stop using [0] arrays to access packet contents

patch at http://xenbits.xenproject.org/gitweb/?p=xen.git;a=commit;h=3471cafbdda35eacf04670881dd2aee2558b4f08

which reduced the size of txb from
sizeof (kdd_hdr) + 65536
to
sizeof (kdd_hdr)
which means the code now tries to write beyond the end of txb in both 
cases.

 	Michael Young