system/qemu
system/qemu
1
0
Fork 0
mirror of https://gitlab.com/qemu-project/qemu synced 2024-11-05 20:35:44 +00:00
Code Issues Projects Releases Packages Wiki Activity

spice-qemu-char: vmc_write: Don't write more bytes then we're asked too

Browse source 
This one took me eons to debug, but I've finally found it now, oh well.

The usage of the MIN macro in this line:
    last_out = MIN(len, qemu_chr_be_can_write(scd->chr));

Causes qemu_chr_be_can_write to be called *twice*, since the MIN macro
evaluates its arguments twice (bad MIN macro, bad!). And the result of
the call can change between the 2 calls since the guest may have consumed
some data from the virtio ringbuffer between the calls!

When this happens it is possible for qemu_chr_be_can_write to return less
then len in the call made for the comparision, and then to return more then
len in the actual call for the return-value of MIN, after which we will end
up writing len data + some extra garbage, not good.

This patch fixes this by only calling qemu_chr_be_can_write once.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
This commit is contained in:
Hans de Goede 2013-04-05 11:30:24 +02:00 committed by Gerd Hoffmann
parent b010cec86b
commit 75c439bc65
1 changed files with 2 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
spice-qemu-char.c
View file

@ -35,7 +35,8 @@ static int vmc_write(SpiceCharDeviceInstance *sin, const uint8_t *buf, int len)
uint8_t* p = (uint8_t*)buf;
while (len > 0) {
last_out = MIN(len, qemu_chr_be_can_write(scd->chr));
int can_write = qemu_chr_be_can_write(scd->chr);
last_out = MIN(len, can_write);
if (last_out <= 0) {
break;
}