From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:55221) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VoDXe-0001id-Nw for qemu-devel@nongnu.org; Wed, 04 Dec 2013 09:35:25 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1VoDXV-0002mh-33 for qemu-devel@nongnu.org; Wed, 04 Dec 2013 09:35:06 -0500 Received: from e9.ny.us.ibm.com ([32.97.182.139]:37216) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VoDXU-0002mK-Tl for qemu-devel@nongnu.org; Wed, 04 Dec 2013 09:34:57 -0500 Received: from /spool/local by e9.ny.us.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Wed, 4 Dec 2013 09:34:56 -0500 From: Michael Roth Date: Wed, 4 Dec 2013 08:34:16 -0600 Message-Id: <1386167679-13021-10-git-send-email-mdroth@linux.vnet.ibm.com> In-Reply-To: <1386167679-13021-1-git-send-email-mdroth@linux.vnet.ibm.com> References: <1386167679-13021-1-git-send-email-mdroth@linux.vnet.ibm.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Subject: [Qemu-devel] [PATCH 09/32] qemu-char: Fix potential out of bounds access to local arrays List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org From: Stefan Weil Latest gcc-4.8 supports a new option -fsanitize=address which activates an AddressSanitizer. This AddressSanitizer stops the QEMU system emulation very early because two character arrays of size 8 are potentially written with 9 bytes. Commit 6ea314d91439741e95772dfbab98b4135e04bebb added the code. There is no obvious reason why width or height could need 8 characters, so reduce it to 7 characters which together with the terminating '\0' fit into the arrays. Cc: qemu-stable Signed-off-by: Stefan Weil Reviewed-by: Alex Bennée Signed-off-by: Michael Tokarev (cherry picked from commit 49aa4058ac6dd0081aaa45776f07c98df397ca5e) Signed-off-by: Michael Roth --- qemu-char.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/qemu-char.c b/qemu-char.c index fc1c23d..649c9f9 100644 --- a/qemu-char.c +++ b/qemu-char.c @@ -2969,11 +2969,11 @@ QemuOpts *qemu_chr_parse_compat(const char *label, const char *filename) if (strstart(filename, "vc", &p)) { qemu_opt_set(opts, "backend", "vc"); if (*p == ':') { - if (sscanf(p+1, "%8[0-9]x%8[0-9]", width, height) == 2) { + if (sscanf(p+1, "%7[0-9]x%7[0-9]", width, height) == 2) { /* pixels */ qemu_opt_set(opts, "width", width); qemu_opt_set(opts, "height", height); - } else if (sscanf(p+1, "%8[0-9]Cx%8[0-9]C", width, height) == 2) { + } else if (sscanf(p+1, "%7[0-9]Cx%7[0-9]C", width, height) == 2) { /* chars */ qemu_opt_set(opts, "cols", width); qemu_opt_set(opts, "rows", height); -- 1.7.9.5