From: Markus Armbruster <armbru@redhat.com>
Subject: Re: [Qemu-devel] [PATCH] block: Fix serial number assignment
References: <20100602174631.2f681a4c@redhat.com>
Date: Thu, 03 Jun 2010 09:00:29 +0200
In-Reply-To: <20100602174631.2f681a4c@redhat.com> (Luiz Capitulino's message
	of "Wed, 2 Jun 2010 17:46:31 -0300")
Message-ID: <m3zkzcmwhe.fsf@blackfin.pond.sub.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
To: Luiz Capitulino <lcapitulino@redhat.com>
Cc: kwolf@redhat.com, qemu-devel@nongnu.org

Luiz Capitulino <lcapitulino@redhat.com> writes:

> We should use 'dinfo->serial' length, 'serial' is a pointer, so
> the serial number length is currently limited to the pointer size.
>
> This fixes https://bugs.launchpad.net/qemu/+bug/584143 and is also
> valid for stable.
>
> Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
> ---
>  vl.c |    2 +-
>  1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/vl.c b/vl.c
> index 417554f..3de2166 100644
> --- a/vl.c
> +++ b/vl.c
> @@ -1060,7 +1060,7 @@ DriveInfo *drive_init(QemuOpts *opts, void *opaque,
>      dinfo->on_write_error = on_write_error;
>      dinfo->opts = opts;
>      if (serial)
> -        strncpy(dinfo->serial, serial, sizeof(serial));
> +        strncpy(dinfo->serial, serial, sizeof(dinfo->serial) - 1);
>      QTAILQ_INSERT_TAIL(&drives, dinfo, next);
>  
>      switch(type) {

Correct, because dinfo->serial[] is zero-initialized.

Patch conflicts with my "blockdev: Collect block device code in new
blockdev.c", but resolution is trivial.