References: bsc#1112188 CVE-2018-18438

Suggested-by: Paolo Bonzini <address@hidden>
Signed-off-by: Philippe Mathieu-Daudé <address@hidden>
---
 chardev/baum.c         | 2 +-
 chardev/char-fd.c      | 2 +-
 chardev/char-mux.c     | 2 +-
 chardev/char-pty.c     | 2 +-
 chardev/char-ringbuf.c | 4 ++--
 chardev/char-socket.c  | 2 +-
 chardev/char-udp.c     | 2 +-
 chardev/char.c         | 2 +-
 chardev/msmouse.c      | 2 +-
 chardev/spice.c        | 2 +-
 chardev/testdev.c      | 2 +-
 chardev/wctablet.c     | 4 ++--
 gdbstub.c              | 2 +-
 hw/bt/hci-csr.c        | 4 ++--
 include/chardev/char.h | 2 +-
 ui/console.c           | 2 +-
 ui/gtk.c               | 2 +-
 17 files changed, 20 insertions(+), 20 deletions(-)

Index: xen-4.4.4-testing/tools/qemu-xen-dir-remote/backends/baum.c
===================================================================
--- xen-4.4.4-testing.orig/tools/qemu-xen-dir-remote/backends/baum.c
+++ xen-4.4.4-testing/tools/qemu-xen-dir-remote/backends/baum.c
@@ -429,7 +429,7 @@ static int baum_eat_packet(BaumDriverSta
 }
 
 /* The other end is writing some data.  Store it and try to interpret */
-static int baum_write(CharDriverState *chr, const uint8_t *buf, int len)
+static size_t baum_write(CharDriverState *chr, const uint8_t *buf, size_t len)
 {
     BaumDriverState *baum = chr->opaque;
     int tocopy, cur, eaten, orig_len = len;
Index: xen-4.4.4-testing/tools/qemu-xen-dir-remote/qemu-char.c
===================================================================
--- xen-4.4.4-testing.orig/tools/qemu-xen-dir-remote/qemu-char.c
+++ xen-4.4.4-testing/tools/qemu-xen-dir-remote/qemu-char.c
@@ -230,7 +230,7 @@ void qemu_chr_add_handlers(CharDriverSta
     }
 }
 
-static int null_chr_write(CharDriverState *chr, const uint8_t *buf, int len)
+static size_t null_chr_write(CharDriverState *chr, const uint8_t *buf, size_t len)
 {
     return len;
 }
@@ -271,7 +271,7 @@ typedef struct {
 } MuxDriver;
 
 
-static int mux_chr_write(CharDriverState *chr, const uint8_t *buf, int len)
+static size_t mux_chr_write(CharDriverState *chr, const uint8_t *buf, size_t len)
 {
     MuxDriver *d = chr->opaque;
     int ret;
@@ -816,7 +816,7 @@ typedef struct FDCharDriver {
     QTAILQ_ENTRY(FDCharDriver) node;
 } FDCharDriver;
 
-static int fd_chr_write(CharDriverState *chr, const uint8_t *buf, int len)
+static size_t fd_chr_write(CharDriverState *chr, const uint8_t *buf, size_t len)
 {
     FDCharDriver *s = chr->opaque;
     
@@ -1052,7 +1052,7 @@ static void pty_chr_rearm_timer(CharDriv
     }
 }
 
-static int pty_chr_write(CharDriverState *chr, const uint8_t *buf, int len)
+static size_t pty_chr_write(CharDriverState *chr, const uint8_t *buf, size_t len)
 {
     PtyCharDriver *s = chr->opaque;
 
@@ -2164,7 +2164,7 @@ typedef struct {
     int max_size;
 } NetCharDriver;
 
-static int udp_chr_write(CharDriverState *chr, const uint8_t *buf, int len)
+static size_t udp_chr_write(CharDriverState *chr, const uint8_t *buf, size_t len)
 {
     NetCharDriver *s = chr->opaque;
     gsize bytes_written;
@@ -2304,7 +2304,7 @@ typedef struct {
 
 static gboolean tcp_chr_accept(GIOChannel *chan, GIOCondition cond, void *opaque);
 
-static int tcp_chr_write(CharDriverState *chr, const uint8_t *buf, int len)
+static size_t tcp_chr_write(CharDriverState *chr, const uint8_t *buf, size_t len)
 {
     TCPCharDriver *s = chr->opaque;
     if (s->connected) {
@@ -2767,7 +2767,7 @@ static size_t ringbuf_count(const CharDr
     return d->prod - d->cons;
 }
 
-static int ringbuf_chr_write(CharDriverState *chr, const uint8_t *buf, int len)
+static size_t ringbuf_chr_write(CharDriverState *chr, const uint8_t *buf, size_t len)
 {
     RingBufCharDriver *d = chr->opaque;
     int i;
Index: xen-4.4.4-testing/tools/qemu-xen-dir-remote/backends/msmouse.c
===================================================================
--- xen-4.4.4-testing.orig/tools/qemu-xen-dir-remote/backends/msmouse.c
+++ xen-4.4.4-testing/tools/qemu-xen-dir-remote/backends/msmouse.c
@@ -52,7 +52,7 @@ static void msmouse_event(void *opaque,
     qemu_chr_be_write(chr, bytes, 4);
 }
 
-static int msmouse_chr_write (struct CharDriverState *s, const uint8_t *buf, int len)
+static size_t msmouse_chr_write (struct CharDriverState *s, const uint8_t *buf, size_t len)
 {
     /* Ignore writes to mouse port */
     return len;
Index: xen-4.4.4-testing/tools/qemu-xen-dir-remote/spice-qemu-char.c
===================================================================
--- xen-4.4.4-testing.orig/tools/qemu-xen-dir-remote/spice-qemu-char.c
+++ xen-4.4.4-testing/tools/qemu-xen-dir-remote/spice-qemu-char.c
@@ -180,7 +180,7 @@ static GSource *spice_chr_add_watch(Char
     return (GSource *)src;
 }
 
-static int spice_chr_write(CharDriverState *chr, const uint8_t *buf, int len)
+static size_t spice_chr_write(CharDriverState *chr, const uint8_t *buf, size_t len)
 {
     SpiceCharDriver *s = chr->opaque;
     int read_bytes;
Index: xen-4.4.4-testing/tools/qemu-xen-dir-remote/gdbstub.c
===================================================================
--- xen-4.4.4-testing.orig/tools/qemu-xen-dir-remote/gdbstub.c
+++ xen-4.4.4-testing/tools/qemu-xen-dir-remote/gdbstub.c
@@ -1647,7 +1647,7 @@ static void gdb_monitor_output(GDBState
     put_packet(s, buf);
 }
 
-static int gdb_monitor_write(CharDriverState *chr, const uint8_t *buf, int len)
+static size_t gdb_monitor_write(CharDriverState *chr, const uint8_t *buf, size_t len)
 {
     const char *p = (const char *)buf;
     int max_sz;
Index: xen-4.4.4-testing/tools/qemu-xen-dir-remote/hw/bt/hci-csr.c
===================================================================
--- xen-4.4.4-testing.orig/tools/qemu-xen-dir-remote/hw/bt/hci-csr.c
+++ xen-4.4.4-testing/tools/qemu-xen-dir-remote/hw/bt/hci-csr.c
@@ -294,8 +294,8 @@ static int csrhci_data_len(const uint8_t
     exit(-1);
 }
 
-static int csrhci_write(struct CharDriverState *chr,
-                const uint8_t *buf, int len)
+static size_t csrhci_write(struct CharDriverState *chr,
+                const uint8_t *buf, size_t len)
 {
     struct csrhci_s *s = (struct csrhci_s *) chr->opaque;
     int plen = s->in_len;
Index: xen-4.4.4-testing/tools/qemu-xen-dir-remote/include/sysemu/char.h
===================================================================
--- xen-4.4.4-testing.orig/tools/qemu-xen-dir-remote/include/sysemu/char.h
+++ xen-4.4.4-testing/tools/qemu-xen-dir-remote/include/sysemu/char.h
@@ -55,7 +55,7 @@ typedef void IOEventHandler(void *opaque
 
 struct CharDriverState {
     void (*init)(struct CharDriverState *s);
-    int (*chr_write)(struct CharDriverState *s, const uint8_t *buf, int len);
+    size_t (*chr_write)(struct CharDriverState *s, const uint8_t *buf, size_t len);
     GSource *(*chr_add_watch)(struct CharDriverState *s, GIOCondition cond);
     void (*chr_update_read_handler)(struct CharDriverState *s);
     int (*chr_ioctl)(struct CharDriverState *s, int cmd, void *arg);
Index: xen-4.4.4-testing/tools/qemu-xen-dir-remote/ui/gtk.c
===================================================================
--- xen-4.4.4-testing.orig/tools/qemu-xen-dir-remote/ui/gtk.c
+++ xen-4.4.4-testing/tools/qemu-xen-dir-remote/ui/gtk.c
@@ -1116,7 +1116,7 @@ static gboolean gd_focus_out_event(GtkWi
 
 /** Virtual Console Callbacks **/
 
-static int gd_vc_chr_write(CharDriverState *chr, const uint8_t *buf, int len)
+static size_t gd_vc_chr_write(CharDriverState *chr, const uint8_t *buf, size_t len)
 {
     VirtualConsole *vc = chr->opaque;
 
