Merge branch 'upstream-merge'qemu-kvm-1.2.0-rc2

* upstream-merge: (47 commits)
  w32: Fix broken build
  Update version for 1.2.0-rc2
  scsi-disk: Fix typo (uint32 -> uint32_t)
  msix: make [un]use vectors on reset/load optional
  kvm: get/set PV EOI MSR
  linux-headers: update to 3.6-rc3
  target-i386: disable pv eoi to fix migration across QEMU versions
  reset PMBA and PMREGMISC PIIX4 registers.
  qemu-ga: Fix null pointer passed to unlink in failure branch
  memory: Fix copy&paste mistake in memory_region_iorange_write
  ivshmem: remove redundant ioeventfd configuration
  hw/arm_gic.c: Define .class_size in arm_gic_info TypeInfo
  tcg/mips: fix broken CONFIG_TCG_PASS_AREG0 code
  Update OpenBIOS PPC image
  target-ppc: fix altivec instructions
  audio/winwave: previous audio buffer should be flushed
  iscsi: Set number of blocks to 0 for blank CDROM devices
  scsi: more fixes to properties for passthrough devices
  esp: support 24-bit DMA
  megasas: Add 'hba_serial' property
  ...

Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>

1 files changed, 5 insertions, 6 deletions

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 11743065e..6257a04d0 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -7025,15 +7025,14 @@ abi_long do_syscall(void *cpu_env, int num, abi_long arg1,
 		tde = target_dirp;
                 while (len > 0) {
                     reclen = de->d_reclen;
-		    treclen = reclen - (2 * (sizeof(long) - sizeof(abi_long)));
+                    tnamelen = reclen - offsetof(struct linux_dirent, d_name);
+                    assert(tnamelen >= 0);
+                    treclen = tnamelen + offsetof(struct target_dirent, d_name);
+                    assert(count1 + treclen <= count);
                     tde->d_reclen = tswap16(treclen);
                     tde->d_ino = tswapal(de->d_ino);
                     tde->d_off = tswapal(de->d_off);
-		    tnamelen = treclen - (2 * sizeof(abi_long) + 2);
-		    if (tnamelen > 256)
-                        tnamelen = 256;
-                    /* XXX: may not be correct */
-                    pstrcpy(tde->d_name, tnamelen, de->d_name);
+                    memcpy(tde->d_name, de->d_name, tnamelen);
                     de = (struct linux_dirent *)((char *)de + reclen);
                     len -= reclen;
                     tde = (struct target_dirent *)((char *)tde + treclen);