[Qemu-devel] [PATCH v2] hw/i386: fix unbounded stack for load_multiboot

* [Qemu-devel] [PATCH v2] hw/i386: fix unbounded stack for load_multiboot
@ 2016-03-09  8:30 Peter Xu
  2016-03-11 18:34 ` Eduardo Habkost
  0 siblings, 1 reply; 2+ messages in thread
From: Peter Xu @ 2016-03-09  8:30 UTC (permalink / raw)
  To: qemu-devel; +Cc: peter.maydell, famz, ehabkost, mst, peterx, pbonzini, rth

Use heap rather than stack for kcmdline.

Signed-off-by: Peter Xu <peterx@redhat.com>
---
 hw/i386/multiboot.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/i386/multiboot.c b/hw/i386/multiboot.c
index 9e164e6..ddc3780 100644
--- a/hw/i386/multiboot.c
+++ b/hw/i386/multiboot.c
@@ -158,6 +158,7 @@ int load_multiboot(FWCfgState *fw_cfg,
     uint8_t bootinfo[MBI_SIZE];
     uint8_t *mb_bootinfo_data;
     uint32_t cmdline_len;
+    char *kcmdline = NULL;
 
     /* Ok, let's see if it is a multiboot image.
        The header is 12x32bit long, so the latest entry may be 8192 - 48. */
@@ -324,10 +325,9 @@ int load_multiboot(FWCfgState *fw_cfg,
     }
 
     /* Commandline support */
-    char kcmdline[strlen(kernel_filename) + strlen(kernel_cmdline) + 2];
-    snprintf(kcmdline, sizeof(kcmdline), "%s %s",
-             kernel_filename, kernel_cmdline);
+    kcmdline = g_strdup_printf("%s %s", kernel_filename, kernel_cmdline);
     stl_p(bootinfo + MBI_CMDLINE, mb_add_cmdline(&mbs, kcmdline));
+    g_free(kcmdline);
 
     stl_p(bootinfo + MBI_BOOTLOADER, mb_add_bootloader(&mbs, bootloader_name));
 
-- 
2.4.3

^ permalink raw reply related	[flat|nested] 2+ messages in thread