a346af9c88
GCC 8 introduced the -Wstringop-overflow, which detect buffer overflow by string-modifying functions declared in <string.h>, such strncpy(), used in global_state_store_running(). GCC indeed found an incorrect use of strlen(), because this array is loaded by VMSTATE_BUFFER(runstate, GlobalState) then parsed using qapi_enum_parse which does not get the buffer length. Use strnlen() which returns sizeof(s->runstate) if the array is not NUL-terminated, assert the size is within range, and enforce the array to be NUL-terminated to avoid an overflow in qapi_enum_parse(). This fixes: CC migration/global_state.o qemu/migration/global_state.c: In function 'global_state_pre_save': qemu/migration/global_state.c:109:15: error: 'strlen' argument 1 declared attribute 'nonstring' [-Werror=stringop-overflow=] s->size = strlen((char *)s->runstate) + 1; ^~~~~~~~~~~~~~~~~~~~~~~~~~~ qemu/migration/global_state.c:24:13: note: argument 'runstate' declared here uint8_t runstate[100] QEMU_NONSTRING; ^~~~~~~~ cc1: all warnings being treated as errors make: *** [qemu/rules.mak:69: migration/global_state.o] Error 1 Suggested-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> |
||
---|---|---|
.. | ||
block-dirty-bitmap.c | ||
block.c | ||
block.h | ||
channel.c | ||
channel.h | ||
colo-failover.c | ||
colo.c | ||
exec.c | ||
exec.h | ||
fd.c | ||
fd.h | ||
global_state.c | ||
Makefile.objs | ||
migration.c | ||
migration.h | ||
page_cache.c | ||
page_cache.h | ||
postcopy-ram.c | ||
postcopy-ram.h | ||
qemu-file-channel.c | ||
qemu-file-channel.h | ||
qemu-file.c | ||
qemu-file.h | ||
qjson.c | ||
qjson.h | ||
ram.c | ||
ram.h | ||
rdma.c | ||
rdma.h | ||
savevm.c | ||
savevm.h | ||
socket.c | ||
socket.h | ||
tls.c | ||
tls.h | ||
trace-events | ||
vmstate-types.c | ||
vmstate.c | ||
xbzrle.c | ||
xbzrle.h |