From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:36093) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1adGie-0003Ye-Rb for qemu-devel@nongnu.org; Tue, 08 Mar 2016 07:26:33 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1adGia-0008TT-Ou for qemu-devel@nongnu.org; Tue, 08 Mar 2016 07:26:32 -0500 Received: from mx1.redhat.com ([209.132.183.28]:50074) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1adGia-0008TP-Ij for qemu-devel@nongnu.org; Tue, 08 Mar 2016 07:26:28 -0500 Received: from int-mx10.intmail.prod.int.phx2.redhat.com (int-mx10.intmail.prod.int.phx2.redhat.com [10.5.11.23]) by mx1.redhat.com (Postfix) with ESMTPS id 0EE3C351E65 for ; Tue, 8 Mar 2016 12:26:27 +0000 (UTC) References: <1457420446-25276-1-git-send-email-peterx@redhat.com> <1457420446-25276-8-git-send-email-peterx@redhat.com> From: Paolo Bonzini Message-ID: <56DEC4F0.7010306@redhat.com> Date: Tue, 8 Mar 2016 13:26:24 +0100 MIME-Version: 1.0 In-Reply-To: <1457420446-25276-8-git-send-email-peterx@redhat.com> Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] [PATCH 7/8] migration: fix unbounded stack for source_return_path_thread List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Peter Xu , qemu-devel@nongnu.org Cc: Amit Shah , Juan Quintela On 08/03/2016 08:00, Peter Xu wrote: > Suggested-by: Paolo Bonzini > CC: Juan Quintela > CC: Amit Shah > Signed-off-by: Peter Xu > --- > migration/migration.c | 7 ++++--- > 1 file changed, 4 insertions(+), 3 deletions(-) > > diff --git a/migration/migration.c b/migration/migration.c > index 0129d9f..f1a3976 100644 > --- a/migration/migration.c > +++ b/migration/migration.c > @@ -1265,11 +1265,11 @@ static void migrate_handle_rp_req_pages(MigrationState *ms, const char* rbname, > */ > static void *source_return_path_thread(void *opaque) > { > +#define __MAX_LEN (512) > MigrationState *ms = opaque; > QEMUFile *rp = ms->rp_state.from_dst_file; > uint16_t header_len, header_type; > - const int max_len = 512; > - uint8_t buf[max_len]; > + uint8_t buf[__MAX_LEN]; > uint32_t tmp32, sibling_error; > ram_addr_t start = 0; /* =0 to silence warning */ > size_t len = 0, expected_len; > @@ -1292,7 +1292,7 @@ static void *source_return_path_thread(void *opaque) > > if ((rp_cmd_args[header_type].len != -1 && > header_len != rp_cmd_args[header_type].len) || > - header_len > max_len) { > + header_len > __MAX_LEN) { > error_report("RP: Received '%s' message (0x%04x) with" > "incorrect length %d expecting %zu", > rp_cmd_args[header_type].name, header_type, header_len, > @@ -1372,6 +1372,7 @@ out: > ms->rp_state.from_dst_file = NULL; > qemu_fclose(rp); > return NULL; > +#undef __MAX_LEN > } > > static int open_return_path_on_source(MigrationState *ms) > Another compiler false positive that you can fix with ARRAY_SIZE. Paolo