From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:34826) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1adZVq-0001d2-31 for qemu-devel@nongnu.org; Wed, 09 Mar 2016 03:30:34 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1adZVk-0006Aj-Sm for qemu-devel@nongnu.org; Wed, 09 Mar 2016 03:30:33 -0500 Received: from mx1.redhat.com ([209.132.183.28]:48483) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1adZVk-0006AX-Nz for qemu-devel@nongnu.org; Wed, 09 Mar 2016 03:30:28 -0500 From: Peter Xu Date: Wed, 9 Mar 2016 16:30:10 +0800 Message-Id: <1457512210-2835-1-git-send-email-peterx@redhat.com> Subject: [Qemu-devel] [PATCH v2] hw/i386: fix unbounded stack for load_multiboot List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: peter.maydell@linaro.org, famz@redhat.com, ehabkost@redhat.com, mst@redhat.com, peterx@redhat.com, pbonzini@redhat.com, rth@twiddle.net Use heap rather than stack for kcmdline. Signed-off-by: Peter Xu --- hw/i386/multiboot.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/hw/i386/multiboot.c b/hw/i386/multiboot.c index 9e164e6..ddc3780 100644 --- a/hw/i386/multiboot.c +++ b/hw/i386/multiboot.c @@ -158,6 +158,7 @@ int load_multiboot(FWCfgState *fw_cfg, uint8_t bootinfo[MBI_SIZE]; uint8_t *mb_bootinfo_data; uint32_t cmdline_len; + char *kcmdline = NULL; /* Ok, let's see if it is a multiboot image. The header is 12x32bit long, so the latest entry may be 8192 - 48. */ @@ -324,10 +325,9 @@ int load_multiboot(FWCfgState *fw_cfg, } /* Commandline support */ - char kcmdline[strlen(kernel_filename) + strlen(kernel_cmdline) + 2]; - snprintf(kcmdline, sizeof(kcmdline), "%s %s", - kernel_filename, kernel_cmdline); + kcmdline = g_strdup_printf("%s %s", kernel_filename, kernel_cmdline); stl_p(bootinfo + MBI_CMDLINE, mb_add_cmdline(&mbs, kcmdline)); + g_free(kcmdline); stl_p(bootinfo + MBI_BOOTLOADER, mb_add_bootloader(&mbs, bootloader_name)); -- 2.4.3