References: bsc#1112188 CVE-2018-18438

The number of bytes can not be negative nor zero.

Fixed 2 format string:
- hw/char/spapr_vty.c
- hw/usb/ccid-card-passthru.c

Suggested-by: Paolo Bonzini <address@hidden>
Signed-off-by: Philippe Mathieu-Daudé <address@hidden>
Acked-by: Alberto Garcia <address@hidden>
---
 backends/rng-egd.c          | 2 +-
 chardev/char-mux.c          | 2 +-
 gdbstub.c                   | 2 +-
 hw/arm/pxa2xx.c             | 2 +-
 hw/arm/strongarm.c          | 3 ++-
 hw/char/bcm2835_aux.c       | 2 +-
 hw/char/cadence_uart.c      | 2 +-
 hw/char/cmsdk-apb-uart.c    | 2 +-
 hw/char/digic-uart.c        | 2 +-
 hw/char/escc.c              | 2 +-
 hw/char/etraxfs_ser.c       | 2 +-
 hw/char/exynos4210_uart.c   | 3 ++-
 hw/char/grlib_apbuart.c     | 2 +-
 hw/char/imx_serial.c        | 2 +-
 hw/char/ipoctal232.c        | 2 +-
 hw/char/lm32_juart.c        | 2 +-
 hw/char/lm32_uart.c         | 2 +-
 hw/char/mcf_uart.c          | 2 +-
 hw/char/milkymist-uart.c    | 2 +-
 hw/char/pl011.c             | 2 +-
 hw/char/sclpconsole-lm.c    | 2 +-
 hw/char/sclpconsole.c       | 2 +-
 hw/char/serial.c            | 4 ++--
 hw/char/sh_serial.c         | 2 +-
 hw/char/spapr_vty.c         | 4 ++--
 hw/char/stm32f2xx_usart.c   | 3 ++-
 hw/char/terminal3270.c      | 2 +-
 hw/char/virtio-console.c    | 2 +-
 hw/char/xen_console.c       | 2 +-
 hw/char/xilinx_uartlite.c   | 2 +-
 hw/ipmi/ipmi_bmc_extern.c   | 2 +-
 hw/misc/ivshmem.c           | 4 ++--
 hw/riscv/riscv_htif.c       | 2 +-
 hw/riscv/sifive_uart.c      | 2 +-
 hw/usb/ccid-card-passthru.c | 4 ++--
 hw/usb/dev-serial.c         | 2 +-
 hw/usb/redirect.c           | 2 +-
 include/qemu/main-loop.h    | 2 +-
 monitor.c                   | 4 ++--
 net/colo-compare.c          | 4 ++--
 net/filter-mirror.c         | 2 +-
 net/slirp.c                 | 2 +-
 qtest.c                     | 2 +-
 target/xtensa/xtensa-semi.c | 2 +-
 44 files changed, 53 insertions(+), 50 deletions(-)

Index: xen-4.2.5-testing/tools/qemu-xen-dir-remote/qemu-char.c
===================================================================
--- xen-4.2.5-testing.orig/tools/qemu-xen-dir-remote/qemu-char.c
+++ xen-4.2.5-testing/tools/qemu-xen-dir-remote/qemu-char.c
@@ -413,7 +413,7 @@ static int mux_chr_can_read(void *opaque
     return 0;
 }
 
-static void mux_chr_read(void *opaque, const uint8_t *buf, int size)
+static void mux_chr_read(void *opaque, const uint8_t *buf, size_t size)
 {
     CharDriverState *chr = opaque;
     MuxDriver *d = chr->opaque;
Index: xen-4.2.5-testing/tools/qemu-xen-dir-remote/hw/grlib_apbuart.c
===================================================================
--- xen-4.2.5-testing.orig/tools/qemu-xen-dir-remote/hw/grlib_apbuart.c
+++ xen-4.2.5-testing/tools/qemu-xen-dir-remote/hw/grlib_apbuart.c
@@ -85,7 +85,7 @@ static int grlib_apbuart_can_receive(voi
     return !!(uart->status & UART_DATA_READY);
 }
 
-static void grlib_apbuart_receive(void *opaque, const uint8_t *buf, int size)
+static void grlib_apbuart_receive(void *opaque, const uint8_t *buf, size_t size)
 {
     UART *uart = opaque;
 
Index: xen-4.2.5-testing/tools/qemu-xen-dir-remote/hw/lm32_juart.c
===================================================================
--- xen-4.2.5-testing.orig/tools/qemu-xen-dir-remote/hw/lm32_juart.c
+++ xen-4.2.5-testing/tools/qemu-xen-dir-remote/hw/lm32_juart.c
@@ -84,7 +84,7 @@ void lm32_juart_set_jrx(DeviceState *d,
     s->jrx &= ~JRX_FULL;
 }
 
-static void juart_rx(void *opaque, const uint8_t *buf, int size)
+static void juart_rx(void *opaque, const uint8_t *buf, size_t size)
 {
     LM32JuartState *s = opaque;
 
Index: xen-4.2.5-testing/tools/qemu-xen-dir-remote/hw/lm32_uart.c
===================================================================
--- xen-4.2.5-testing.orig/tools/qemu-xen-dir-remote/hw/lm32_uart.c
+++ xen-4.2.5-testing/tools/qemu-xen-dir-remote/hw/lm32_uart.c
@@ -204,7 +204,7 @@ static CPUWriteMemoryFunc * const uart_w
     &uart_write,
 };
 
-static void uart_rx(void *opaque, const uint8_t *buf, int size)
+static void uart_rx(void *opaque, const uint8_t *buf, size_t size)
 {
     LM32UartState *s = opaque;
 
Index: xen-4.2.5-testing/tools/qemu-xen-dir-remote/hw/mcf_uart.c
===================================================================
--- xen-4.2.5-testing.orig/tools/qemu-xen-dir-remote/hw/mcf_uart.c
+++ xen-4.2.5-testing/tools/qemu-xen-dir-remote/hw/mcf_uart.c
@@ -261,7 +261,7 @@ static int mcf_uart_can_receive(void *op
     return s->rx_enabled && (s->sr & MCF_UART_FFULL) == 0;
 }
 
-static void mcf_uart_receive(void *opaque, const uint8_t *buf, int size)
+static void mcf_uart_receive(void *opaque, const uint8_t *buf, size_t size)
 {
     mcf_uart_state *s = (mcf_uart_state *)opaque;
 
Index: xen-4.2.5-testing/tools/qemu-xen-dir-remote/hw/milkymist-uart.c
===================================================================
--- xen-4.2.5-testing.orig/tools/qemu-xen-dir-remote/hw/milkymist-uart.c
+++ xen-4.2.5-testing/tools/qemu-xen-dir-remote/hw/milkymist-uart.c
@@ -153,7 +153,7 @@ static const MemoryRegionOps uart_mmio_o
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
-static void uart_rx(void *opaque, const uint8_t *buf, int size)
+static void uart_rx(void *opaque, const uint8_t *buf, size_t size)
 {
     MilkymistUartState *s = opaque;
 
Index: xen-4.2.5-testing/tools/qemu-xen-dir-remote/hw/pl011.c
===================================================================
--- xen-4.2.5-testing.orig/tools/qemu-xen-dir-remote/hw/pl011.c
+++ xen-4.2.5-testing/tools/qemu-xen-dir-remote/hw/pl011.c
@@ -212,7 +212,7 @@ static void pl011_put_fifo(void *opaque,
     }
 }
 
-static void pl011_receive(void *opaque, const uint8_t *buf, int size)
+static void pl011_receive(void *opaque, const uint8_t *buf, size_t size)
 {
     pl011_put_fifo(opaque, *buf);
 }
Index: xen-4.2.5-testing/tools/qemu-xen-dir-remote/hw/serial.c
===================================================================
--- xen-4.2.5-testing.orig/tools/qemu-xen-dir-remote/hw/serial.c
+++ xen-4.2.5-testing/tools/qemu-xen-dir-remote/hw/serial.c
@@ -164,7 +164,7 @@ typedef struct ISASerialState {
     SerialState state;
 } ISASerialState;
 
-static void serial_receive1(void *opaque, const uint8_t *buf, int size);
+static void serial_receive1(void *opaque, const uint8_t *buf, size_t size);
 
 static void fifo_clear(SerialState *s, int fifo)
 {
@@ -633,7 +633,7 @@ static int serial_can_receive1(void *opa
     return serial_can_receive(s);
 }
 
-static void serial_receive1(void *opaque, const uint8_t *buf, int size)
+static void serial_receive1(void *opaque, const uint8_t *buf, size_t size)
 {
     SerialState *s = opaque;
     if(s->fcr & UART_FCR_FE) {
Index: xen-4.2.5-testing/tools/qemu-xen-dir-remote/hw/sh_serial.c
===================================================================
--- xen-4.2.5-testing.orig/tools/qemu-xen-dir-remote/hw/sh_serial.c
+++ xen-4.2.5-testing/tools/qemu-xen-dir-remote/hw/sh_serial.c
@@ -305,7 +305,7 @@ static int sh_serial_can_receive1(void *
     return sh_serial_can_receive(s);
 }
 
-static void sh_serial_receive1(void *opaque, const uint8_t *buf, int size)
+static void sh_serial_receive1(void *opaque, const uint8_t *buf, size_t size)
 {
     sh_serial_state *s = opaque;
 
Index: xen-4.2.5-testing/tools/qemu-xen-dir-remote/hw/spapr_vty.c
===================================================================
--- xen-4.2.5-testing.orig/tools/qemu-xen-dir-remote/hw/spapr_vty.c
+++ xen-4.2.5-testing/tools/qemu-xen-dir-remote/hw/spapr_vty.c
@@ -19,7 +19,7 @@ static int vty_can_receive(void *opaque)
     return (dev->in - dev->out) < VTERM_BUFSIZE;
 }
 
-static void vty_receive(void *opaque, const uint8_t *buf, int size)
+static void vty_receive(void *opaque, const uint8_t *buf, size_t size)
 {
     VIOsPAPRVTYDevice *dev = (VIOsPAPRVTYDevice *)opaque;
     int i;
Index: xen-4.2.5-testing/tools/qemu-xen-dir-remote/hw/virtio-console.c
===================================================================
--- xen-4.2.5-testing.orig/tools/qemu-xen-dir-remote/hw/virtio-console.c
+++ xen-4.2.5-testing/tools/qemu-xen-dir-remote/hw/virtio-console.c
@@ -72,7 +72,7 @@ static int chr_can_read(void *opaque)
 }
 
 /* Send data from a char device over to the guest */
-static void chr_read(void *opaque, const uint8_t *buf, int size)
+static void chr_read(void *opaque, const uint8_t *buf, size_t size)
 {
     VirtConsole *vcon = opaque;
 
Index: xen-4.2.5-testing/tools/qemu-xen-dir-remote/hw/xen_console.c
===================================================================
--- xen-4.2.5-testing.orig/tools/qemu-xen-dir-remote/hw/xen_console.c
+++ xen-4.2.5-testing/tools/qemu-xen-dir-remote/hw/xen_console.c
@@ -127,7 +127,7 @@ static int xencons_can_receive(void *opa
     return ring_free_bytes(con);
 }
 
-static void xencons_receive(void *opaque, const uint8_t *buf, int len)
+static void xencons_receive(void *opaque, const uint8_t *buf, size_t len)
 {
     struct XenConsole *con = opaque;
     struct xencons_interface *intf = con->sring;
Index: xen-4.2.5-testing/tools/qemu-xen-dir-remote/hw/xilinx_uartlite.c
===================================================================
--- xen-4.2.5-testing.orig/tools/qemu-xen-dir-remote/hw/xilinx_uartlite.c
+++ xen-4.2.5-testing/tools/qemu-xen-dir-remote/hw/xilinx_uartlite.c
@@ -161,7 +161,7 @@ static const MemoryRegionOps uart_ops =
     }
 };
 
-static void uart_rx(void *opaque, const uint8_t *buf, int size)
+static void uart_rx(void *opaque, const uint8_t *buf, size_t size)
 {
     struct xlx_uartlite *s = opaque;
 
Index: xen-4.2.5-testing/tools/qemu-xen-dir-remote/hw/ccid-card-passthru.c
===================================================================
--- xen-4.2.5-testing.orig/tools/qemu-xen-dir-remote/hw/ccid-card-passthru.c
+++ xen-4.2.5-testing/tools/qemu-xen-dir-remote/hw/ccid-card-passthru.c
@@ -203,14 +203,14 @@ static void ccid_card_vscard_drop_connec
     card->vscard_in_pos = card->vscard_in_hdr = 0;
 }
 
-static void ccid_card_vscard_read(void *opaque, const uint8_t *buf, int size)
+static void ccid_card_vscard_read(void *opaque, const uint8_t *buf, size_t size)
 {
     PassthruState *card = opaque;
     VSCMsgHeader *hdr;
 
     if (card->vscard_in_pos + size > VSCARD_IN_SIZE) {
         error_report(
-            "no room for data: pos %d +  size %d > %d. dropping connection.",
+            "no room for data: pos %d +  size %zu > %d. dropping connection.",
             card->vscard_in_pos, size, VSCARD_IN_SIZE);
         ccid_card_vscard_drop_connection(card);
         return;
Index: xen-4.2.5-testing/tools/qemu-xen-dir-remote/hw/usb-serial.c
===================================================================
--- xen-4.2.5-testing.orig/tools/qemu-xen-dir-remote/hw/usb-serial.c
+++ xen-4.2.5-testing/tools/qemu-xen-dir-remote/hw/usb-serial.c
@@ -437,7 +437,7 @@ static int usb_serial_can_read(void *opa
     return RECV_BUF - s->recv_used;
 }
 
-static void usb_serial_read(void *opaque, const uint8_t *buf, int size)
+static void usb_serial_read(void *opaque, const uint8_t *buf, size_t size)
 {
     USBSerialState *s = opaque;
     int first_size, start;
Index: xen-4.2.5-testing/tools/qemu-xen-dir-remote/usb-redir.c
===================================================================
--- xen-4.2.5-testing.orig/tools/qemu-xen-dir-remote/usb-redir.c
+++ xen-4.2.5-testing/tools/qemu-xen-dir-remote/usb-redir.c
@@ -766,7 +766,7 @@ static int usbredir_chardev_can_read(voi
     }
 }
 
-static void usbredir_chardev_read(void *opaque, const uint8_t *buf, int size)
+static void usbredir_chardev_read(void *opaque, const uint8_t *buf, size_t size)
 {
     USBRedirDevice *dev = opaque;
 
Index: xen-4.2.5-testing/tools/qemu-xen-dir-remote/main-loop.h
===================================================================
--- xen-4.2.5-testing.orig/tools/qemu-xen-dir-remote/main-loop.h
+++ xen-4.2.5-testing/tools/qemu-xen-dir-remote/main-loop.h
@@ -163,7 +163,7 @@ void qemu_del_wait_object(HANDLE handle,
 
 /* async I/O support */
 
-typedef void IOReadHandler(void *opaque, const uint8_t *buf, int size);
+typedef void IOReadHandler(void *opaque, const uint8_t *buf, size_t size);
 typedef int IOCanReadHandler(void *opaque);
 typedef void IOHandler(void *opaque);
 
Index: xen-4.2.5-testing/tools/qemu-xen-dir-remote/monitor.c
===================================================================
--- xen-4.2.5-testing.orig/tools/qemu-xen-dir-remote/monitor.c
+++ xen-4.2.5-testing/tools/qemu-xen-dir-remote/monitor.c
@@ -4709,7 +4709,7 @@ out:
 /**
  * monitor_control_read(): Read and handle QMP input
  */
-static void monitor_control_read(void *opaque, const uint8_t *buf, int size)
+static void monitor_control_read(void *opaque, const uint8_t *buf, size_t size)
 {
     Monitor *old_mon = cur_mon;
 
@@ -4720,7 +4720,7 @@ static void monitor_control_read(void *o
     cur_mon = old_mon;
 }
 
-static void monitor_read(void *opaque, const uint8_t *buf, int size)
+static void monitor_read(void *opaque, const uint8_t *buf, size_t size)
 {
     Monitor *old_mon = cur_mon;
     int i;
Index: xen-4.2.5-testing/tools/qemu-xen-dir-remote/net/slirp.c
===================================================================
--- xen-4.2.5-testing.orig/tools/qemu-xen-dir-remote/net/slirp.c
+++ xen-4.2.5-testing/tools/qemu-xen-dir-remote/net/slirp.c
@@ -569,7 +569,7 @@ static int guestfwd_can_read(void *opaqu
     return slirp_socket_can_recv(fwd->slirp, fwd->server, fwd->port);
 }
 
-static void guestfwd_read(void *opaque, const uint8_t *buf, int size)
+static void guestfwd_read(void *opaque, const uint8_t *buf, size_t size)
 {
     struct GuestFwd *fwd = opaque;
     slirp_socket_recv(fwd->slirp, fwd->server, fwd->port, buf, size);
