diff options
| author | Peter Maydell <peter.maydell@linaro.org> | 2023-08-24 16:32:22 +0100 |
|---|---|---|
| committer | Jason Wang <jasowang@redhat.com> | 2023-09-18 14:36:13 +0800 |
| commit | 1257065783df26a83934195a5cd70f951ef9c51d (patch) | |
| tree | 015128f91cd5c1d149f295dcbfe736bf77a85bef | |
| parent | 2a6cb383e2ec7224d8631c3c0a324bff469c9c64 (diff) | |
| download | qemu-1257065783df26a83934195a5cd70f951ef9c51d.zip qemu-1257065783df26a83934195a5cd70f951ef9c51d.tar.gz qemu-1257065783df26a83934195a5cd70f951ef9c51d.tar.bz2 | |
hw/net/rocker: Avoid variable length array
Replace an on-stack variable length array in of_dpa_ig() with
a g_autofree heap allocation.
The codebase has very few VLAs, and if we can get rid of them all we
can make the compiler error on new additions. This is a defensive
measure against security bugs where an on-stack dynamic allocation
isn't correctly size-checked (e.g. CVE-2021-3527).
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
| -rw-r--r-- | hw/net/rocker/rocker_of_dpa.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/hw/net/rocker/rocker_of_dpa.c b/hw/net/rocker/rocker_of_dpa.c index dfe4754..5e16056 100644 --- a/hw/net/rocker/rocker_of_dpa.c +++ b/hw/net/rocker/rocker_of_dpa.c @@ -1043,7 +1043,7 @@ static void of_dpa_flow_ig_tbl(OfDpaFlowContext *fc, uint32_t tbl_id) static ssize_t of_dpa_ig(World *world, uint32_t pport, const struct iovec *iov, int iovcnt) { - struct iovec iov_copy[iovcnt + 2]; + g_autofree struct iovec *iov_copy = g_new(struct iovec, iovcnt + 2); OfDpaFlowContext fc = { .of_dpa = world_private(world), .in_pport = pport, |