QObject patches for 2018-07-27 (3.0.0-rc3)

-----BEGIN PGP SIGNATURE-----
 
 iQIcBAABAgAGBQJbXBbvAAoJEDhwtADrkYZTaB4P/3Tq0rloDyKS23RA1o9682fd
 N3tOpDIS4tMsHY/mwNZ9lPLCVSScBy+w7JebB5XsWDLB57Ccj84jQKDfQT1MWAxT
 +LuhH+xQXtQalOpsmnMvHv07dJAHBjlgJoYFmlJhf0rRCnMgCvC+XzV76Z+4Wu1t
 hRCPMK2yFrP5BGPzWmJ1zVo4emCsk6UPoGp0g+6DdKBSEQkBTpk6CPoLEKounXK7
 f3v/p5oCD1eWj0nw0m3haCam1uUgRWbbmIPQB4i9H2qRHqVhDZhBFzuuTviaLh0j
 XJML+fGMLvgEJuU+ZO/o9Ye/NN6RBYrALeMJ+mshGHYjyDRSVgzB2eUPzgAK76TV
 CK37Ei2DqehIwoWiyI0Q67GCp9uSTUVSnCli+7KDj/j9vJ8Ar/XbZGRQ0ZC6rYjp
 In8qsL39xHCkgJYVIiLp8s9izVrpP2U8OEe9ZOpvBUXZy/MZHf6UYmMN4QUN4d9M
 Yju9Q7gBCXrYkRxY4pZhjbfD4njNWhaQnYqOe9QOe89/1Ne7UOE+F3wp8kxQXvb+
 ISOYAKKQUZQoGFQ9s1DxVWGnGY0hv/IcKyZIcLBX3a2l3IeOQpZpcKx1OYGR0mmO
 JnM1iEMTH9qclOfiA976pOv2l+lV1FJom+rSXClKwdvXxsToGJj4R/5mG2vcqOee
 P+cTTzYz78LCYjepKOHk
 =3ilO
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/armbru/tags/pull-qobject-2018-07-27-v2' into staging

QObject patches for 2018-07-27 (3.0.0-rc3)

# gpg: Signature made Sat 28 Jul 2018 08:10:39 BST
# gpg:                using RSA key 3870B400EB918653
# gpg: Good signature from "Markus Armbruster <armbru@redhat.com>"
# gpg:                 aka "Markus Armbruster <armbru@pond.sub.org>"
# Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867  4E5F 3870 B400 EB91 8653

* remotes/armbru/tags/pull-qobject-2018-07-27-v2:
  qstring: Move qstring_from_substr()'s @end one to the right
  qstring: Assert size calculations don't overflow
  qstring: Fix qstring_from_substr() not to provoke int overflow

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

block/blkdebug.c

@@ -305,7 +305,7 @@ static void blkdebug_parse_filename(const char *filename, QDict *options,
 
     if (c != filename) {
         QString *config_path;
-        config_path = qstring_from_substr(filename, 0, c - filename - 1);
+        config_path = qstring_from_substr(filename, 0, c - filename);
         qdict_put(options, "config", config_path);
     }
 

block/blkverify.c

@@ -80,7 +80,7 @@ static void blkverify_parse_filename(const char *filename, QDict *options,
     }
 
     /* TODO Implement option pass-through and set raw.filename here */
-    raw_path = qstring_from_substr(filename, 0, c - filename - 1);
+    raw_path = qstring_from_substr(filename, 0, c - filename);
     qdict_put(options, "x-raw", raw_path);
 
     /* TODO Allow multi-level nesting and set file.filename here */

block/nbd.c

@@ -109,7 +109,7 @@ static int nbd_parse_uri(const char *filename, QDict *options)
         /* strip braces from literal IPv6 address */
         if (uri->server[0] == '[') {
             host = qstring_from_substr(uri->server, 1,
-                                       strlen(uri->server) - 2);
+                                       strlen(uri->server) - 1);
         } else {
             host = qstring_from_str(uri->server);
         }

include/qapi/qmp/qstring.h

@@ -24,7 +24,7 @@ struct QString {
 
 QString *qstring_new(void);
 QString *qstring_from_str(const char *str);
-QString *qstring_from_substr(const char *str, int start, int end);
+QString *qstring_from_substr(const char *str, size_t start, size_t end);
 size_t qstring_get_length(const QString *qstring);
 const char *qstring_get_str(const QString *qstring);
 const char *qstring_get_try_str(const QString *qstring);

qobject/qstring.c

@@ -37,21 +37,23 @@ size_t qstring_get_length(const QString *qstring)
  *
  * Return string reference
  */
-QString *qstring_from_substr(const char *str, int start, int end)
+QString *qstring_from_substr(const char *str, size_t start, size_t end)
 {
     QString *qstring;
 
+    assert(start <= end);
+
     qstring = g_malloc(sizeof(*qstring));
     qobject_init(QOBJECT(qstring), QTYPE_QSTRING);
 
-    qstring->length = end - start + 1;
+    qstring->length = end - start;
     qstring->capacity = qstring->length;
 
+    assert(qstring->capacity < SIZE_MAX);
     qstring->string = g_malloc(qstring->capacity + 1);
     memcpy(qstring->string, str + start, qstring->length);
     qstring->string[qstring->length] = 0;
 
-
     return qstring;
 }
 
@@ -62,13 +64,15 @@ QString *qstring_from_substr(const char *str, int start, int end)
  */
 QString *qstring_from_str(const char *str)
 {
-    return qstring_from_substr(str, 0, strlen(str) - 1);
+    return qstring_from_substr(str, 0, strlen(str));
 }
 
 static void capacity_increase(QString *qstring, size_t len)
 {
     if (qstring->capacity < (qstring->length + len)) {
+        assert(len <= SIZE_MAX - qstring->capacity);
         qstring->capacity += len;
+        assert(qstring->capacity <= SIZE_MAX / 2);
         qstring->capacity *= 2; /* use exponential growth */
 
         qstring->string = g_realloc(qstring->string, qstring->capacity + 1);

tests/check-qobject.c

@@ -154,7 +154,7 @@ static void qobject_is_equal_string_test(void)
     str_case = qstring_from_str("Foo");
 
     /* Should yield "foo" */
-    str_built = qstring_from_substr("form", 0, 1);
+    str_built = qstring_from_substr("form", 0, 2);
     qstring_append_chr(str_built, 'o');
 
     check_unequal(str_base, str_whitespace_0, str_whitespace_1,

tests/check-qstring.c

@@ -66,7 +66,7 @@ static void qstring_from_substr_test(void)
 {
     QString *qs;
 
-    qs = qstring_from_substr("virtualization", 3, 9);
+    qs = qstring_from_substr("virtualization", 3, 10);
     g_assert(qs != NULL);
     g_assert(strcmp(qstring_get_str(qs), "tualiza") == 0);