References: bsc#1112188 CVE-2018-18438

Suggested-by: Paolo Bonzini <address@hidden>
Signed-off-by: Philippe Mathieu-Daudé <address@hidden>
---
 backends/rng-egd.c          | 4 ++--
 chardev/char-mux.c          | 2 +-
 gdbstub.c                   | 2 +-
 hw/arm/pxa2xx.c             | 2 +-
 hw/arm/strongarm.c          | 2 +-
 hw/char/bcm2835_aux.c       | 2 +-
 hw/char/cadence_uart.c      | 4 ++--
 hw/char/cmsdk-apb-uart.c    | 2 +-
 hw/char/digic-uart.c        | 2 +-
 hw/char/escc.c              | 6 +++---
 hw/char/etraxfs_ser.c       | 2 +-
 hw/char/exynos4210_uart.c   | 2 +-
 hw/char/grlib_apbuart.c     | 2 +-
 hw/char/imx_serial.c        | 2 +-
 hw/char/ipoctal232.c        | 4 ++--
 hw/char/lm32_juart.c        | 2 +-
 hw/char/lm32_uart.c         | 2 +-
 hw/char/mcf_uart.c          | 2 +-
 hw/char/milkymist-uart.c    | 2 +-
 hw/char/parallel.c          | 2 +-
 hw/char/pl011.c             | 4 ++--
 hw/char/sclpconsole-lm.c    | 2 +-
 hw/char/sclpconsole.c       | 4 ++--
 hw/char/serial.c            | 4 ++--
 hw/char/sh_serial.c         | 4 ++--
 hw/char/spapr_vty.c         | 2 +-
 hw/char/stm32f2xx_usart.c   | 2 +-
 hw/char/terminal3270.c      | 2 +-
 hw/char/virtio-console.c    | 2 +-
 hw/char/xen_console.c       | 2 +-
 hw/char/xilinx_uartlite.c   | 2 +-
 hw/ipmi/ipmi_bmc_extern.c   | 2 +-
 hw/misc/ivshmem.c           | 2 +-
 hw/riscv/riscv_htif.c       | 2 +-
 hw/riscv/sifive_uart.c      | 2 +-
 hw/usb/ccid-card-passthru.c | 2 +-
 hw/usb/dev-serial.c         | 2 +-
 hw/usb/redirect.c           | 2 +-
 include/qemu/main-loop.h    | 2 +-
 monitor.c                   | 2 +-
 net/colo-compare.c          | 2 +-
 net/filter-mirror.c         | 2 +-
 net/slirp.c                 | 2 +-
 qtest.c                     | 2 +-
 target/xtensa/xtensa-semi.c | 2 +-
 45 files changed, 54 insertions(+), 54 deletions(-)


Index: xen-4.2.5-testing/tools/qemu-xen-dir-remote/qemu-char.c
===================================================================
--- xen-4.2.5-testing.orig/tools/qemu-xen-dir-remote/qemu-char.c
+++ xen-4.2.5-testing/tools/qemu-xen-dir-remote/qemu-char.c
@@ -400,7 +400,7 @@ static void mux_chr_accept_input(CharDri
     }
 }
 
-static int mux_chr_can_read(void *opaque)
+static size_t mux_chr_can_read(void *opaque)
 {
     CharDriverState *chr = opaque;
     MuxDriver *d = chr->opaque;
Index: xen-4.2.5-testing/tools/qemu-xen-dir-remote/hw/ivshmem.c
===================================================================
--- xen-4.2.5-testing.orig/tools/qemu-xen-dir-remote/hw/ivshmem.c
+++ xen-4.2.5-testing/tools/qemu-xen-dir-remote/hw/ivshmem.c
@@ -257,7 +257,7 @@ static void ivshmem_receive(void *opaque
     IVSHMEM_DPRINTF("ivshmem_receive 0x%02x\n", *buf);
 }
 
-static int ivshmem_can_receive(void * opaque)
+static size_t ivshmem_can_receive(void * opaque)
 {
     return 8;
 }
Index: xen-4.2.5-testing/tools/qemu-xen-dir-remote/hw/ccid-card-passthru.c
===================================================================
--- xen-4.2.5-testing.orig/tools/qemu-xen-dir-remote/hw/ccid-card-passthru.c
+++ xen-4.2.5-testing/tools/qemu-xen-dir-remote/hw/ccid-card-passthru.c
@@ -104,7 +104,7 @@ static void ccid_card_vscard_send_init(P
                          (uint8_t *)&msg, sizeof(msg));
 }
 
-static int ccid_card_vscard_can_read(void *opaque)
+static size_t ccid_card_vscard_can_read(void *opaque)
 {
     PassthruState *card = opaque;
 
Index: xen-4.2.5-testing/tools/qemu-xen-dir-remote/hw/usb-serial.c
===================================================================
--- xen-4.2.5-testing.orig/tools/qemu-xen-dir-remote/hw/usb-serial.c
+++ xen-4.2.5-testing/tools/qemu-xen-dir-remote/hw/usb-serial.c
@@ -431,7 +431,7 @@ static void usb_serial_handle_destroy(US
     qemu_chr_delete(s->cs);
 }
 
-static int usb_serial_can_read(void *opaque)
+static size_t usb_serial_can_read(void *opaque)
 {
     USBSerialState *s = opaque;
     return RECV_BUF - s->recv_used;
Index: xen-4.2.5-testing/tools/qemu-xen-dir-remote/usb-redir.c
===================================================================
--- xen-4.2.5-testing.orig/tools/qemu-xen-dir-remote/usb-redir.c
+++ xen-4.2.5-testing/tools/qemu-xen-dir-remote/usb-redir.c
@@ -753,7 +753,7 @@ static void usbredir_do_attach(void *opa
  * chardev callbacks
  */
 
-static int usbredir_chardev_can_read(void *opaque)
+static size_t usbredir_chardev_can_read(void *opaque)
 {
     USBRedirDevice *dev = opaque;
 
Index: xen-4.2.5-testing/tools/qemu-xen-dir-remote/main-loop.h
===================================================================
--- xen-4.2.5-testing.orig/tools/qemu-xen-dir-remote/main-loop.h
+++ xen-4.2.5-testing/tools/qemu-xen-dir-remote/main-loop.h
@@ -164,7 +164,7 @@ void qemu_del_wait_object(HANDLE handle,
 /* async I/O support */
 
 typedef void IOReadHandler(void *opaque, const uint8_t *buf, size_t size);
-typedef int IOCanReadHandler(void *opaque);
+typedef size_t IOCanReadHandler(void *opaque);
 typedef void IOHandler(void *opaque);
 
 /**
Index: xen-4.2.5-testing/tools/qemu-xen-dir-remote/monitor.c
===================================================================
--- xen-4.2.5-testing.orig/tools/qemu-xen-dir-remote/monitor.c
+++ xen-4.2.5-testing/tools/qemu-xen-dir-remote/monitor.c
@@ -4361,7 +4361,7 @@ cleanup:
     }
 }
 
-static int monitor_can_read(void *opaque)
+static size_t monitor_can_read(void *opaque)
 {
     Monitor *mon = opaque;
 
Index: xen-4.2.5-testing/tools/qemu-xen-dir-remote/net/slirp.c
===================================================================
--- xen-4.2.5-testing.orig/tools/qemu-xen-dir-remote/net/slirp.c
+++ xen-4.2.5-testing/tools/qemu-xen-dir-remote/net/slirp.c
@@ -563,7 +563,7 @@ struct GuestFwd {
     Slirp *slirp;
 };
 
-static int guestfwd_can_read(void *opaque)
+static size_t guestfwd_can_read(void *opaque)
 {
     struct GuestFwd *fwd = opaque;
     return slirp_socket_can_recv(fwd->slirp, fwd->server, fwd->port);
