References: bsc#1112188 CVE-2018-18438

Suggested-by: Paolo Bonzini <address@hidden>
Signed-off-by: Philippe Mathieu-Daudé <address@hidden>
---
 chardev/baum.c         | 2 +-
 chardev/char-fd.c      | 2 +-
 chardev/char-mux.c     | 2 +-
 chardev/char-pty.c     | 2 +-
 chardev/char-ringbuf.c | 4 ++--
 chardev/char-socket.c  | 2 +-
 chardev/char-udp.c     | 2 +-
 chardev/char.c         | 2 +-
 chardev/msmouse.c      | 2 +-
 chardev/spice.c        | 2 +-
 chardev/testdev.c      | 2 +-
 chardev/wctablet.c     | 4 ++--
 gdbstub.c              | 2 +-
 hw/bt/hci-csr.c        | 4 ++--
 include/chardev/char.h | 2 +-
 ui/console.c           | 2 +-
 ui/gtk.c               | 2 +-
 17 files changed, 20 insertions(+), 20 deletions(-)

Index: xen-4.2.5-testing/tools/qemu-xen-dir-remote/hw/baum.c
===================================================================
--- xen-4.2.5-testing.orig/tools/qemu-xen-dir-remote/hw/baum.c
+++ xen-4.2.5-testing/tools/qemu-xen-dir-remote/hw/baum.c
@@ -430,7 +430,7 @@ static int baum_eat_packet(BaumDriverSta
 }
 
 /* The other end is writing some data.  Store it and try to interpret */
-static int baum_write(CharDriverState *chr, const uint8_t *buf, int len)
+static size_t baum_write(CharDriverState *chr, const uint8_t *buf, size_t len)
 {
     BaumDriverState *baum = chr->opaque;
     int tocopy, cur, eaten, orig_len = len;
Index: xen-4.2.5-testing/tools/qemu-xen-dir-remote/qemu-char.c
===================================================================
--- xen-4.2.5-testing.orig/tools/qemu-xen-dir-remote/qemu-char.c
+++ xen-4.2.5-testing/tools/qemu-xen-dir-remote/qemu-char.c
@@ -216,7 +216,7 @@ void qemu_chr_add_handlers(CharDriverSta
     }
 }
 
-static int null_chr_write(CharDriverState *chr, const uint8_t *buf, int len)
+static size_t null_chr_write(CharDriverState *chr, const uint8_t *buf, size_t len)
 {
     return len;
 }
@@ -258,7 +258,7 @@ typedef struct {
 } MuxDriver;
 
 
-static int mux_chr_write(CharDriverState *chr, const uint8_t *buf, int len)
+static size_t mux_chr_write(CharDriverState *chr, const uint8_t *buf, size_t len)
 {
     MuxDriver *d = chr->opaque;
     int ret;
@@ -552,7 +552,7 @@ typedef struct {
 } FDCharDriver;
 
 
-static int fd_chr_write(CharDriverState *chr, const uint8_t *buf, int len)
+static size_t fd_chr_write(CharDriverState *chr, const uint8_t *buf, size_t len)
 {
     FDCharDriver *s = chr->opaque;
     return send_all(s->fd_out, buf, len);
@@ -871,7 +871,7 @@ typedef struct {
 static void pty_chr_update_read_handler(CharDriverState *chr);
 static void pty_chr_state(CharDriverState *chr, int connected);
 
-static int pty_chr_write(CharDriverState *chr, const uint8_t *buf, int len)
+static size_t pty_chr_write(CharDriverState *chr, const uint8_t *buf, size_t len)
 {
     PtyCharDriver *s = chr->opaque;
 
@@ -2048,7 +2048,7 @@ typedef struct {
     int max_size;
 } NetCharDriver;
 
-static int udp_chr_write(CharDriverState *chr, const uint8_t *buf, int len)
+static size_t udp_chr_write(CharDriverState *chr, const uint8_t *buf, size_t len)
 {
     NetCharDriver *s = chr->opaque;
 
@@ -2166,7 +2166,7 @@ typedef struct {
 
 static void tcp_chr_accept(void *opaque);
 
-static int tcp_chr_write(CharDriverState *chr, const uint8_t *buf, int len)
+static size_t tcp_chr_write(CharDriverState *chr, const uint8_t *buf, size_t len)
 {
     TCPCharDriver *s = chr->opaque;
     if (s->connected) {
Index: xen-4.2.5-testing/tools/qemu-xen-dir-remote/hw/msmouse.c
===================================================================
--- xen-4.2.5-testing.orig/tools/qemu-xen-dir-remote/hw/msmouse.c
+++ xen-4.2.5-testing/tools/qemu-xen-dir-remote/hw/msmouse.c
@@ -53,7 +53,7 @@ static void msmouse_event(void *opaque,
     qemu_chr_be_write(chr, bytes, 4);
 }
 
-static int msmouse_chr_write (struct CharDriverState *s, const uint8_t *buf, int len)
+static size_t msmouse_chr_write (struct CharDriverState *s, const uint8_t *buf, size_t len)
 {
     /* Ignore writes to mouse port */
     return len;
Index: xen-4.2.5-testing/tools/qemu-xen-dir-remote/spice-qemu-char.c
===================================================================
--- xen-4.2.5-testing.orig/tools/qemu-xen-dir-remote/spice-qemu-char.c
+++ xen-4.2.5-testing/tools/qemu-xen-dir-remote/spice-qemu-char.c
@@ -132,7 +132,7 @@ static void vmc_unregister_interface(Spi
 }
 
 
-static int spice_chr_write(CharDriverState *chr, const uint8_t *buf, int len)
+static size_t spice_chr_write(CharDriverState *chr, const uint8_t *buf, size_t len)
 {
     SpiceCharDriver *s = chr->opaque;
 
Index: xen-4.2.5-testing/tools/qemu-xen-dir-remote/gdbstub.c
===================================================================
--- xen-4.2.5-testing.orig/tools/qemu-xen-dir-remote/gdbstub.c
+++ xen-4.2.5-testing/tools/qemu-xen-dir-remote/gdbstub.c
@@ -2833,7 +2833,7 @@ static void gdb_monitor_output(GDBState
     put_packet(s, buf);
 }
 
-static int gdb_monitor_write(CharDriverState *chr, const uint8_t *buf, int len)
+static size_t gdb_monitor_write(CharDriverState *chr, const uint8_t *buf, size_t len)
 {
     const char *p = (const char *)buf;
     int max_sz;
Index: xen-4.2.5-testing/tools/qemu-xen-dir-remote/hw/bt-hci-csr.c
===================================================================
--- xen-4.2.5-testing.orig/tools/qemu-xen-dir-remote/hw/bt-hci-csr.c
+++ xen-4.2.5-testing/tools/qemu-xen-dir-remote/hw/bt-hci-csr.c
@@ -294,8 +294,8 @@ static int csrhci_data_len(const uint8_t
     exit(-1);
 }
 
-static int csrhci_write(struct CharDriverState *chr,
-                const uint8_t *buf, int len)
+static size_t csrhci_write(struct CharDriverState *chr,
+                const uint8_t *buf, size_t len)
 {
     struct csrhci_s *s = (struct csrhci_s *) chr->opaque;
     int plen = s->in_len;
Index: xen-4.2.5-testing/tools/qemu-xen-dir-remote/qemu-char.h
===================================================================
--- xen-4.2.5-testing.orig/tools/qemu-xen-dir-remote/qemu-char.h
+++ xen-4.2.5-testing/tools/qemu-xen-dir-remote/qemu-char.h
@@ -54,7 +54,7 @@ typedef void IOEventHandler(void *opaque
 
 struct CharDriverState {
     void (*init)(struct CharDriverState *s);
-    int (*chr_write)(struct CharDriverState *s, const uint8_t *buf, int len);
+    size_t (*chr_write)(struct CharDriverState *s, const uint8_t *buf, size_t len);
     void (*chr_update_read_handler)(struct CharDriverState *s);
     int (*chr_ioctl)(struct CharDriverState *s, int cmd, void *arg);
     int (*get_msgfd)(struct CharDriverState *s);
