diff options
| author | Stefan Hajnoczi <stefanha@redhat.com> | 2015-03-23 15:29:23 +0000 |
|---|---|---|
| committer | Michael Roth <mdroth@linux.vnet.ibm.com> | 2015-07-28 17:46:44 -0500 |
| commit | d3b59789e821909ad19902dbc1f4aecd93584c0f (patch) | |
| tree | bcfbd83170f3ef0df43db4f4978170ca3162c776 | |
| parent | e5b3a24181ea0cebf1c5b20f44d016311b7048f0 (diff) | |
| download | qemu-d3b59789e821909ad19902dbc1f4aecd93584c0f.zip qemu-d3b59789e821909ad19902dbc1f4aecd93584c0f.tar.gz qemu-d3b59789e821909ad19902dbc1f4aecd93584c0f.tar.bz2 | |
bt-sdp: fix broken uuids power-of-2 calculation
The binary search in sdp_uuid_match() only works when the number of
elements to search is a power of two.
lo = record->uuid;
hi = record->uuids;
while (hi >>= 1)
if (lo[hi] <= val)
lo += hi;
return *lo == val;
I noticed that the record->uuids calculation in
sdp_service_record_build() was suspect:
record->uuids = 1 << ffs(record->uuids - 1);
Unlike most ffs(val) - 1 users, the expression is ffs(val - 1)!
Actually ffs() is the wrong function to use for power-of-2. Use
pow2ceil() to achieve the correct effect. Now the record->uuid[] array
is sized correctly and the binary search in sdp_uuid_match() should
work.
I'm not sure how to run/test this code.
Cc: Andrzej Zaborowski <balrog@zabor.org>
Cc: qemu-stable@nongnu.org
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 1427124571-28598-2-git-send-email-stefanha@redhat.com
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
(cherry picked from commit 588ef9d411339012fc3c94bfad8911e9d0a517a2)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
| -rw-r--r-- | hw/bt/sdp.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/hw/bt/sdp.c b/hw/bt/sdp.c index 218e075..c903747 100644 --- a/hw/bt/sdp.c +++ b/hw/bt/sdp.c @@ -707,7 +707,7 @@ static void sdp_service_record_build(struct sdp_service_record_s *record, len += sdp_attr_max_size(&def->attributes[record->attributes ++].data, &record->uuids); } - record->uuids = 1 << ffs(record->uuids - 1); + record->uuids = pow2ceil(record->uuids); record->attribute_list = g_malloc0(record->attributes * sizeof(*record->attribute_list)); record->uuid = |