[Xen-devel] [PATCH v3 10/25] usb-redir: Verify usbredirparser_write get called with positive count

[Philippe Mathieu-Daudé <philmd@xxxxxxxxxx>]

The usbredirparser_write handler should never be called with a negative
size payload, return an error if this is not the case.
Now that we are sure the 'count' value is positive, make it obvious by
casting it to a size_t.

Signed-off-by: Philippe Mathieu-Daudé <philmd@xxxxxxxxxx>
---
 hw/usb/redirect.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/hw/usb/redirect.c b/hw/usb/redirect.c
index 18a42d1938..131eae2e7e 100644
--- a/hw/usb/redirect.c
+++ b/hw/usb/redirect.c
@@ -285,7 +285,11 @@ static int usbredir_write(void *priv, uint8_t *data, int 
count)
         return 0;
     }
 
-    r = qemu_chr_fe_write(&dev->cs, data, count);
+    if (count < 0) {
+        ERROR("Illegal write count: %i\n", count);
+        return 0;
+    }
+    r = qemu_chr_fe_write(&dev->cs, data, (size_t)count);
     if (r < count) {
         if (!dev->watch) {
             dev->watch = qemu_chr_fe_add_watch(&dev->cs, G_IO_OUT | G_IO_HUP,
-- 
2.20.1


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/mailman/listinfo/xen-devel