[PATCH] hw/i2c/pmbus_device: Fix a possible crash when requesting too many bytes

From: Thomas Huth <[email protected]>

The pmbus_send_string() function contains an assert() statement that
can be triggered by the guest code when requesting too many data
without reading from the device in between. This should not be possible.
pmbus_send() already has a similar logic, but it simply ignores the
error after logging a message with qemu_log_mask(), so do the same now
in pmbus_send_string() to fix the issue.

Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3388
Signed-off-by: Thomas Huth <[email protected]>
---
 hw/i2c/pmbus_device.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/hw/i2c/pmbus_device.c b/hw/i2c/pmbus_device.c
index b1f9843f52e..6aa608a2998 100644
--- a/hw/i2c/pmbus_device.c
+++ b/hw/i2c/pmbus_device.c
@@ -104,7 +104,12 @@ void pmbus_send_string(PMBusDevice *pmdev, const char *data)
     }
 
     size_t len = strlen(data);
-    g_assert(len + pmdev->out_buf_len < SMBUS_DATA_MAX_LEN);
+    if (len + pmdev->out_buf_len >= SMBUS_DATA_MAX_LEN) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: requested too much data from PMBus device\n",
+                      __func__);
+        return;
+    }
     pmdev->out_buf[len + pmdev->out_buf_len] = len;
 
     for (int i = len - 1; i >= 0; i--) {
-- 
2.54.0