hw/i2c/smbus_eeprom: Create at most SMBUS_EEPROM_MAX EEPROMs on a SMBus

Calling smbus_eeprom_init() with more than 8 EEPROMs would lead to a heap overflow.
Replace the '8' magic number by a definition, and check no more than this number are created.

Signed-off-by Philippe Mathieu-Daudé <[email protected]>

---
Based-on: [email protected] "RFC v2: Fix/add vmstate handling in some I2C code"

---
  hw/i2c/smbus_eeprom.c         | 13 +++++++++++--
  include/hw/i2c/smbus_eeprom.h |  4 +++-
  2 files changed, 14 insertions(+), 3 deletions(-)

hw/i2c/smbus_eeprom.c +11 -2

index d0a8d63869..de3a492df4 100644
@@ -23,6 +23,7 @@
   */
 
  #include "qemu/osdep.h"
+#include "qemu/error-report.h"
  #include "hw/hw.h"
  #include "hw/boards.h"
  #include "hw/i2c/i2c.h"

@@ -163,12 +164,20 @@ void smbus_eeprom_init_one(I2CBus *smbus, uint8_t address, uint8_t *eeprom_buf)
      qdev_init_nofail(dev);
  }
 
-void smbus_eeprom_init(I2CBus *smbus, int nb_eeprom,
+void smbus_eeprom_init(I2CBus *smbus, unsigned int nb_eeprom,
                         const uint8_t *eeprom_spd, int eeprom_spd_size)
  {
      int i;
+    uint8_t *eeprom_buf;
+
+    if (nb_eeprom > SMBUS_EEPROM_MAX) {
+        error_report("At most %u EEPROM are supported on a SMBus.",
+                     SMBUS_EEPROM_MAX);
+        exit(1);
+    }
+
       /* XXX: make this persistent */
-    uint8_t *eeprom_buf = g_malloc0(8 * SMBUS_EEPROM_SIZE);
+    eeprom_buf = g_malloc0(nb_eeprom * SMBUS_EEPROM_SIZE);
      if (eeprom_spd_size > 0) {
          memcpy(eeprom_buf, eeprom_spd, eeprom_spd_size);
      }

include/hw/i2c/smbus_eeprom.h +3 -1

index 2f56e5dc4e..cc9d1cdba9 100644
@@ -4,8 +4,10 @@
 
  #include "hw/i2c/i2c.h"
 
+#define SMBUS_EEPROM_MAX 8
+
  void smbus_eeprom_init_one(I2CBus *bus, uint8_t address, uint8_t *eeprom_buf);
-void smbus_eeprom_init(I2CBus *bus, int nb_eeprom,
+void smbus_eeprom_init(I2CBus *bus, unsigned int nb_eeprom,
                         const uint8_t *eeprom_spd, int size);
 
  #endif