[Qemu-devel] [5087] Fix more bugs in r5044

[Qemu-devel] [5087] Fix more bugs in r5044

[Blue Swirl]

Revision: 5087
          http://svn.sv.gnu.org/viewvc/?view=rev&root=qemu&revision=5087
Author:   blueswir1
Date:     2008-08-25 20:43:37 +0000 (Mon, 25 Aug 2008)

Log Message:
-----------
Fix more bugs in r5044

Modified Paths:
--------------
    trunk/audio/audio.c
    trunk/i386-dis.c

Modified: trunk/audio/audio.c
===================================================================
--- trunk/audio/audio.c	2008-08-25 20:03:28 UTC (rev 5086)
+++ trunk/audio/audio.c	2008-08-25 20:43:37 UTC (rev 5087)
@@ -205,7 +205,7 @@
     }
 
     len = strlen (s);
-    r = qemu_malloc (len + sizeof (qemu_prefix));
+    r = qemu_malloc (len + sizeof (qemu_prefix) + 1);
 
     if (r) {
         size_t i;

Modified: trunk/i386-dis.c
===================================================================
--- trunk/i386-dis.c	2008-08-25 20:03:28 UTC (rev 5086)
+++ trunk/i386-dis.c	2008-08-25 20:43:37 UTC (rev 5087)
@@ -2826,7 +2826,7 @@
 oappend (s)
      const char *s;
 {
-  pstrcpy (obufp, (size_t)(obufp - obuf), s);
+  pstrcpy (obufp, sizeof(obuf) - (size_t)(obufp - obuf), s);
   obufp += strlen (s);
 }
 

Re: [Qemu-devel] [5087] Fix more bugs in r5044

[Igor Kovalenko]

On Tue, Aug 26, 2008 at 12:43 AM, Blue Swirl <blauwirbel@gmail.com> wrote:
> Revision: 5087
>          http://svn.sv.gnu.org/viewvc/?view=rev&root=qemu&revision=5087
> Author:   blueswir1
> Date:     2008-08-25 20:43:37 +0000 (Mon, 25 Aug 2008)
>
> Log Message:
> -----------
> Fix more bugs in r5044
>
> Modified Paths:
> --------------
>    trunk/audio/audio.c
>    trunk/i386-dis.c
>
> Modified: trunk/i386-dis.c
> ===================================================================
> --- trunk/i386-dis.c    2008-08-25 20:03:28 UTC (rev 5086)
> +++ trunk/i386-dis.c    2008-08-25 20:43:37 UTC (rev 5087)
> @@ -2826,7 +2826,7 @@
>  oappend (s)
>      const char *s;
>  {
> -  pstrcpy (obufp, (size_t)(obufp - obuf), s);
> +  pstrcpy (obufp, sizeof(obuf) - (size_t)(obufp - obuf), s);
>   obufp += strlen (s);
>  }
>
>

Now the disassembler output is truncated; you need to revert this part
of change to i386-dis.c
The problem is that obufp is not always a pointer into obuf data, see
i386-dis.c:2497      obufp = op1out;

-- 
Kind regards,
Igor V. Kovalenko

Re: [Qemu-devel] [5087] Fix more bugs in r5044

[Blue Swirl]

On 8/26/08, Igor Kovalenko <igor.v.kovalenko@gmail.com> wrote:
> On Tue, Aug 26, 2008 at 12:43 AM, Blue Swirl <blauwirbel@gmail.com> wrote:
>  > Revision: 5087
>  >          http://svn.sv.gnu.org/viewvc/?view=rev&root=qemu&revision=5087
>  > Author:   blueswir1
>  > Date:     2008-08-25 20:43:37 +0000 (Mon, 25 Aug 2008)
>  >
>  > Log Message:
>  > -----------
>  > Fix more bugs in r5044
>  >
>  > Modified Paths:
>  > --------------
>  >    trunk/audio/audio.c
>  >    trunk/i386-dis.c
>  >
>
> > Modified: trunk/i386-dis.c
>  > ===================================================================
>  > --- trunk/i386-dis.c    2008-08-25 20:03:28 UTC (rev 5086)
>  > +++ trunk/i386-dis.c    2008-08-25 20:43:37 UTC (rev 5087)
>  > @@ -2826,7 +2826,7 @@
>  >  oappend (s)
>  >      const char *s;
>  >  {
>  > -  pstrcpy (obufp, (size_t)(obufp - obuf), s);
>  > +  pstrcpy (obufp, sizeof(obuf) - (size_t)(obufp - obuf), s);
>  >   obufp += strlen (s);
>  >  }
>  >
>  >
>
>
> Now the disassembler output is truncated; you need to revert this part
>  of change to i386-dis.c
>  The problem is that obufp is not always a pointer into obuf data, see
>  i386-dis.c:2497      obufp = op1out;

Thanks. I didn't have a plan how to fix this properly, so I reverted it.

Re: [Qemu-devel] [5087] Fix more bugs in r5044

[malc]

On Mon, 25 Aug 2008, Blue Swirl wrote:

> Revision: 5087
>          http://svn.sv.gnu.org/viewvc/?view=rev&root=qemu&revision=5087
> Author:   blueswir1
> Date:     2008-08-25 20:43:37 +0000 (Mon, 25 Aug 2008)
>
> Log Message:
> -----------
> Fix more bugs in r5044
>
> Modified Paths:
> --------------
>    trunk/audio/audio.c
>    trunk/i386-dis.c
>
> Modified: trunk/audio/audio.c
> ===================================================================
> --- trunk/audio/audio.c	2008-08-25 20:03:28 UTC (rev 5086)
> +++ trunk/audio/audio.c	2008-08-25 20:43:37 UTC (rev 5087)
> @@ -205,7 +205,7 @@
>     }
>
>     len = strlen (s);
> -    r = qemu_malloc (len + sizeof (qemu_prefix));
> +    r = qemu_malloc (len + sizeof (qemu_prefix) + 1);
>

This is wrong, sizeof (qemu_prefix) already includes + 1 (trailing
zero is counted).

-- 
mailto:av1474@comtv.ru