fix qdev_print_devinfo()

snprintf returns number of bytes needed for the output, not the number
of bytes actually written.  Thus the math is wrong ...

Spotted by Markus Armbruster.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>
Message-Id: 

hw/qdev.c

@@ -108,15 +108,23 @@ DeviceState *qdev_create(BusState *bus, const char *name)
 static int qdev_print_devinfo(DeviceInfo *info, char *dest, int len)
 {
     int pos = 0;
+    int ret;
 
-    pos += snprintf(dest+pos, len-pos, "name \"%s\", bus %s",
-                    info->name, info->bus_info->name);
-    if (info->alias)
-        pos += snprintf(dest+pos, len-pos, ", alias \"%s\"", info->alias);
-    if (info->desc)
-        pos += snprintf(dest+pos, len-pos, ", desc \"%s\"", info->desc);
-    if (info->no_user)
-        pos += snprintf(dest+pos, len-pos, ", no-user");
+    ret = snprintf(dest+pos, len-pos, "name \"%s\", bus %s",
+                   info->name, info->bus_info->name);
+    pos += MIN(len-pos,ret);
+    if (info->alias) {
+        ret = snprintf(dest+pos, len-pos, ", alias \"%s\"", info->alias);
+        pos += MIN(len-pos,ret);
+    }
+    if (info->desc) {
+        ret = snprintf(dest+pos, len-pos, ", desc \"%s\"", info->desc);
+        pos += MIN(len-pos,ret);
+    }
+    if (info->no_user) {
+        ret = snprintf(dest+pos, len-pos, ", no-user");
+        pos += MIN(len-pos,ret);
+    }
     return pos;
 }