Re: [Qemu-devel] [PATCHv2] multiboot: copy the cmdline verbatim, unescape module strings

[Vlad Lungu]

On 12/15/2016 02:29 PM, Paolo Bonzini wrote:
>
> On 15/12/2016 12:34, Vlad Lungu wrote:
>>
>> On 12/15/2016 12:56 PM, Paolo Bonzini wrote:
>>> On 15/12/2016 11:03, Vlad Lungu wrote:
  
  if (initrd_filename) {
 -char *next_initrd, not_last;
 +char *next_initrd, not_last, tmpbuf[strlen(initrd_filename) + 1];
  
  mbs.offset_mods = mbs.mb_buf_size;
  
 @@ -299,22 +299,24 @@ int load_multiboot(FWCfgState *fw_cfg,
  next_initrd = (char *)get_opt_value(NULL, 0, initrd_filename);
  not_last = *next_initrd;
  *next_initrd = '\0';
 +/* Unescape the filename + eventual arguments */
 +get_opt_value(tmpbuf, strlen(initrd_filename) + 1, 
 initrd_filename);
>>> No need to call get_opt_value twice; you can call it once since you have
>>> declared tmpbuf to hold the entire size of initrd_filename.
>> So what you're saying is to go with
>>
>>  next_initrd = (char *)get_opt_value(tmpbuf, sizeof(tmpbuf), 
>> initrd_filename);
>>
>> and delete the second call to get_opt_value().
>>
>> Is that right?
> Yes, thanks!
>
I'll delete

*next_initrd = '\0';

too, since we're operating on tmpbuf after get_opt_value(), and it's already 
NUL-terminated.

Regards,
Vlad

Re: [Qemu-devel] [PATCHv2] multiboot: copy the cmdline verbatim, unescape module strings

[Paolo Bonzini]

On 15/12/2016 12:34, Vlad Lungu wrote:
> 
> 
> On 12/15/2016 12:56 PM, Paolo Bonzini wrote:
>>
>> On 15/12/2016 11:03, Vlad Lungu wrote:
>>>  
>>>  if (initrd_filename) {
>>> -char *next_initrd, not_last;
>>> +char *next_initrd, not_last, tmpbuf[strlen(initrd_filename) + 1];
>>>  
>>>  mbs.offset_mods = mbs.mb_buf_size;
>>>  
>>> @@ -299,22 +299,24 @@ int load_multiboot(FWCfgState *fw_cfg,
>>>  next_initrd = (char *)get_opt_value(NULL, 0, initrd_filename);
>>>  not_last = *next_initrd;
>>>  *next_initrd = '\0';
>>> +/* Unescape the filename + eventual arguments */
>>> +get_opt_value(tmpbuf, strlen(initrd_filename) + 1, 
>>> initrd_filename);
>> No need to call get_opt_value twice; you can call it once since you have
>> declared tmpbuf to hold the entire size of initrd_filename.
> So what you're saying is to go with
> 
>  next_initrd = (char *)get_opt_value(tmpbuf, sizeof(tmpbuf), 
> initrd_filename);
> 
> and delete the second call to get_opt_value().
> 
> Is that right?

Yes, thanks!

Paolo

Re: [Qemu-devel] [PATCHv2] multiboot: copy the cmdline verbatim, unescape module strings

[Vlad Lungu]

On 12/15/2016 12:56 PM, Paolo Bonzini wrote:
>
> On 15/12/2016 11:03, Vlad Lungu wrote:
>>  
>>  if (initrd_filename) {
>> -char *next_initrd, not_last;
>> +char *next_initrd, not_last, tmpbuf[strlen(initrd_filename) + 1];
>>  
>>  mbs.offset_mods = mbs.mb_buf_size;
>>  
>> @@ -299,22 +299,24 @@ int load_multiboot(FWCfgState *fw_cfg,
>>  next_initrd = (char *)get_opt_value(NULL, 0, initrd_filename);
>>  not_last = *next_initrd;
>>  *next_initrd = '\0';
>> +/* Unescape the filename + eventual arguments */
>> +get_opt_value(tmpbuf, strlen(initrd_filename) + 1, 
>> initrd_filename);
> No need to call get_opt_value twice; you can call it once since you have
> declared tmpbuf to hold the entire size of initrd_filename.
So what you're saying is to go with

 next_initrd = (char *)get_opt_value(tmpbuf, sizeof(tmpbuf), 
initrd_filename);

and delete the second call to get_opt_value().

Is that right?

Regards,
Vlad

Re: [Qemu-devel] [PATCHv2] multiboot: copy the cmdline verbatim, unescape module strings

[Paolo Bonzini]

On 15/12/2016 11:03, Vlad Lungu wrote:
>  
>  if (initrd_filename) {
> -char *next_initrd, not_last;
> +char *next_initrd, not_last, tmpbuf[strlen(initrd_filename) + 1];
>  
>  mbs.offset_mods = mbs.mb_buf_size;
>  
> @@ -299,22 +299,24 @@ int load_multiboot(FWCfgState *fw_cfg,
>  next_initrd = (char *)get_opt_value(NULL, 0, initrd_filename);
>  not_last = *next_initrd;
>  *next_initrd = '\0';
> +/* Unescape the filename + eventual arguments */
> +get_opt_value(tmpbuf, strlen(initrd_filename) + 1, 
> initrd_filename);

No need to call get_opt_value twice; you can call it once since you have
declared tmpbuf to hold the entire size of initrd_filename.

Also, the second argument of get_opt_value can be sizeof(tmpbuf) or
ARRAY_SIZE(tmpbuf), as you prefer.

Paolo

[Qemu-devel] [PATCHv2] multiboot: copy the cmdline verbatim, unescape module strings

[Vlad Lungu]

get_opt_value() truncates the value at the first comma
Use memcpy() instead
Unescape the module filename and parameters with get_opt_value()
before calling mb_add_cmdline()

Signed-off-by: Vlad Lungu 
---
 hw/i386/multiboot.c | 18 ++
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/hw/i386/multiboot.c b/hw/i386/multiboot.c
index 387caa6..37e27f2 100644
--- a/hw/i386/multiboot.c
+++ b/hw/i386/multiboot.c
@@ -109,7 +109,7 @@ static uint32_t mb_add_cmdline(MultibootState *s, const 
char *cmdline)
 hwaddr p = s->offset_cmdlines;
 char *b = (char *)s->mb_buf + p;
 
-get_opt_value(b, strlen(cmdline) + 1, cmdline);
+memcpy(b, cmdline, strlen(cmdline) + 1);
 s->offset_cmdlines += strlen(b) + 1;
 return s->mb_buf_phys + p;
 }
@@ -287,7 +287,7 @@ int load_multiboot(FWCfgState *fw_cfg,
 mbs.offset_bootloader = mbs.offset_cmdlines + cmdline_len;
 
 if (initrd_filename) {
-char *next_initrd, not_last;
+char *next_initrd, not_last, tmpbuf[strlen(initrd_filename) + 1];
 
 mbs.offset_mods = mbs.mb_buf_size;
 
@@ -299,22 +299,24 @@ int load_multiboot(FWCfgState *fw_cfg,
 next_initrd = (char *)get_opt_value(NULL, 0, initrd_filename);
 not_last = *next_initrd;
 *next_initrd = '\0';
+/* Unescape the filename + eventual arguments */
+get_opt_value(tmpbuf, strlen(initrd_filename) + 1, 
initrd_filename);
 /* if a space comes after the module filename, treat everything
after that as parameters */
-hwaddr c = mb_add_cmdline(, initrd_filename);
-if ((next_space = strchr(initrd_filename, ' ')))
+hwaddr c = mb_add_cmdline(, tmpbuf);
+if ((next_space = strchr(tmpbuf, ' ')))
 *next_space = '\0';
-mb_debug("multiboot loading module: %s\n", initrd_filename);
-mb_mod_length = get_image_size(initrd_filename);
+mb_debug("multiboot loading module: %s\n", tmpbuf);
+mb_mod_length = get_image_size(tmpbuf);
 if (mb_mod_length < 0) {
-fprintf(stderr, "Failed to open file '%s'\n", initrd_filename);
+fprintf(stderr, "Failed to open file '%s'\n", tmpbuf);
 exit(1);
 }
 
 mbs.mb_buf_size = TARGET_PAGE_ALIGN(mb_mod_length + 
mbs.mb_buf_size);
 mbs.mb_buf = g_realloc(mbs.mb_buf, mbs.mb_buf_size);
 
-load_image(initrd_filename, (unsigned char *)mbs.mb_buf + offs);
+load_image(tmpbuf, (unsigned char *)mbs.mb_buf + offs);
 mb_add_mod(, mbs.mb_buf_phys + offs,
mbs.mb_buf_phys + offs + mb_mod_length, c);
 
-- 
1.9.1