From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:35337) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1adGed-00012d-NC for qemu-devel@nongnu.org; Tue, 08 Mar 2016 07:22:24 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1adGec-0007gh-Uq for qemu-devel@nongnu.org; Tue, 08 Mar 2016 07:22:23 -0500 Received: from mx1.redhat.com ([209.132.183.28]:45442) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1adGec-0007ga-Iq for qemu-devel@nongnu.org; Tue, 08 Mar 2016 07:22:22 -0500 Received: from int-mx11.intmail.prod.int.phx2.redhat.com (int-mx11.intmail.prod.int.phx2.redhat.com [10.5.11.24]) by mx1.redhat.com (Postfix) with ESMTPS id 48541C076602 for ; Tue, 8 Mar 2016 12:22:22 +0000 (UTC) References: <1457420446-25276-1-git-send-email-peterx@redhat.com> <1457420446-25276-6-git-send-email-peterx@redhat.com> From: Paolo Bonzini Message-ID: <56DEC3FB.2070202@redhat.com> Date: Tue, 8 Mar 2016 13:22:19 +0100 MIME-Version: 1.0 In-Reply-To: <1457420446-25276-6-git-send-email-peterx@redhat.com> Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] [PATCH 5/8] usb: fix unbounded stack for inotify_watchfn List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Peter Xu , qemu-devel@nongnu.org Cc: Gerd Hoffmann On 08/03/2016 08:00, Peter Xu wrote: > Suggested-by: Paolo Bonzini > CC: Gerd Hoffmann > Signed-off-by: Peter Xu > --- > hw/usb/dev-mtp.c | 7 ++++--- > 1 file changed, 4 insertions(+), 3 deletions(-) > > diff --git a/hw/usb/dev-mtp.c b/hw/usb/dev-mtp.c > index 7391783..e6dae2f 100644 > --- a/hw/usb/dev-mtp.c > +++ b/hw/usb/dev-mtp.c > @@ -432,13 +432,13 @@ static void inotify_watchfn(void *arg) > { > MTPState *s = arg; > ssize_t bytes; > +#define __BUF_LEN (sizeof(struct inotify_event) + NAME_MAX + 1) > /* From the man page: atleast one event can be read */ > - int len = sizeof(struct inotify_event) + NAME_MAX + 1; > int pos; > - char buf[len]; > + char buf[__BUF_LEN]; > > for (;;) { > - bytes = read(s->inotifyfd, buf, len); > + bytes = read(s->inotifyfd, buf, __BUF_LEN); Again, here you can use ARRAY_SIZE(buf) and avoid the macro. Paolo > pos = 0; > > if (bytes <= 0) { > @@ -534,6 +534,7 @@ static void inotify_watchfn(void *arg) > } > } > } > +#undef __BUF_LEN > } > > static int usb_mtp_inotify_init(MTPState *s) >