[Qemu-devel] [PATCH 6/8] usb: fix unbounded stack for usb_mtp_add_str

[Peter Xu <peterx@redhat.com>]

Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
CC: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 hw/usb/dev-mtp.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/hw/usb/dev-mtp.c b/hw/usb/dev-mtp.c
index e6dae2f..40fe26e 100644
--- a/hw/usb/dev-mtp.c
+++ b/hw/usb/dev-mtp.c
@@ -718,16 +718,20 @@ static void usb_mtp_add_wstr(MTPData *data, const wchar_t *str)
 
 static void usb_mtp_add_str(MTPData *data, const char *str)
 {
+#define __WSTR_LEN (256)
     uint32_t len = strlen(str)+1;
-    wchar_t wstr[len];
+    wchar_t wstr[__WSTR_LEN];
     size_t ret;
 
+    assert(len <= __WSTR_LEN);
+
     ret = mbstowcs(wstr, str, len);
     if (ret == -1) {
         usb_mtp_add_wstr(data, L"Oops");
     } else {
         usb_mtp_add_wstr(data, wstr);
     }
+#undef __WSTR_LEN
 }
 
 static void usb_mtp_add_time(MTPData *data, time_t time)
-- 
2.4.3