Merge remote-tracking branch 'remotes/mjt/tags/pull-trivial-patches-2015-02-10' into staging

trivial patches for 2015-02-10

# gpg: Signature made Tue 10 Feb 2015 07:27:11 GMT using RSA key ID A4C3D7DB
# gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>"
# gpg:                 aka "Michael Tokarev <mjt@corpit.ru>"
# gpg:                 aka "Michael Tokarev <mjt@debian.org>"

* remotes/mjt/tags/pull-trivial-patches-2015-02-10: (45 commits)
  virtio: Fix warning caused by missing 'static' attribute
  vga: Fix warning caused by missing 'static' attribute
  stubs: Fix warning caused by missing include statement
  spice: Add missing 'static' attribute
  serial: Fix warnings caused by missing 'static' attribute
  moxie: Fix warning caused by missing include statement
  migration: Fix warnings caused by missing 'static' attribute
  migration: Fix warning caused by missing declaration of vmstate_dummy
  disas/sh4: Fix warning caused by missing 'static' attribute
  translate-all: Use g_try_malloc() for dynamic translator buffer
  vnc: g_realloc() can't fail, bury dead error handling
  rdma: g_malloc0() can't fail, bury dead error handling
  kvm: g_malloc() can't fail, bury dead error handling
  rtl8139: g_malloc() can't fail, bury dead error handling
  onenand: g_malloc() can't fail, bury dead error handling
  Fix name error in migration stream analyzation script
  QJSON: fix typo in author's email address
  util/uri: URI member path can be null, compare more carfully
  util/uri: realloc2n() can't fail, drop dead error handling
  util/uri: uri_new() can't fail, drop dead error handling
  ...

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

1 files changed, 19 insertions, 7 deletions

diff --git a/util/qemu-sockets.c b/util/qemu-sockets.c
index a76bb3c913..61fc3c1364 100644
--- a/util/qemu-sockets.c
+++ b/util/qemu-sockets.c
@@ -512,7 +512,7 @@ InetSocketAddress *inet_parse(const char *str, Error **errp)
 {
     InetSocketAddress *addr;
     const char *optstr, *h;
-    char host[64];
+    char host[65];
     char port[33];
     int to;
     int pos;
@@ -694,7 +694,7 @@ int unix_listen_opts(QemuOpts *opts, Error **errp)
 
     sock = qemu_socket(PF_UNIX, SOCK_STREAM, 0);
     if (sock < 0) {
-        error_setg_errno(errp, errno, "Failed to create socket");
+        error_setg_errno(errp, errno, "Failed to create Unix socket");
         return -1;
     }
 
@@ -703,9 +703,15 @@ int unix_listen_opts(QemuOpts *opts, Error **errp)
     if (path && strlen(path)) {
         snprintf(un.sun_path, sizeof(un.sun_path), "%s", path);
     } else {
-        char *tmpdir = getenv("TMPDIR");
-        snprintf(un.sun_path, sizeof(un.sun_path), "%s/qemu-socket-XXXXXX",
-                 tmpdir ? tmpdir : "/tmp");
+        const char *tmpdir = getenv("TMPDIR");
+        tmpdir = tmpdir ? tmpdir : "/tmp";
+        if (snprintf(un.sun_path, sizeof(un.sun_path), "%s/qemu-socket-XXXXXX",
+                     tmpdir) >= sizeof(un.sun_path)) {
+            error_setg_errno(errp, errno,
+                             "TMPDIR environment variable (%s) too large", tmpdir);
+            goto err;
+        }
+
         /*
          * This dummy fd usage silences the mktemp() unsecure warning.
          * Using mkstemp() doesn't make things more secure here
@@ -713,13 +719,19 @@ int unix_listen_opts(QemuOpts *opts, Error **errp)
          * to unlink first and thus re-open the race window.  The
          * worst case possible is bind() failing, i.e. a DoS attack.
          */
-        fd = mkstemp(un.sun_path); close(fd);
+        fd = mkstemp(un.sun_path);
+        if (fd < 0) {
+            error_setg_errno(errp, errno,
+                             "Failed to make a temporary socket name in %s", tmpdir);
+            goto err;
+        }
+        close(fd);
         qemu_opt_set(opts, "path", un.sun_path);
     }
 
     unlink(un.sun_path);
     if (bind(sock, (struct sockaddr*) &un, sizeof(un)) < 0) {
-        error_setg_errno(errp, errno, "Failed to bind socket");
+        error_setg_errno(errp, errno, "Failed to bind socket to %s", un.sun_path);
         goto err;
     }
     if (listen(sock, 1) < 0) {