From b3c8246750b7077add335559341268f2956f6470 Mon Sep 17 00:00:00 2001 From: Peter Maydell Date: Fri, 11 Aug 2023 18:47:51 +0100 Subject: hw/nvme: Avoid dynamic stack allocation Instead of using a variable-length array in nvme_map_prp(), allocate on the stack with a g_autofree pointer. The codebase has very few VLAs, and if we can get rid of them all we can make the compiler error on new additions. This is a defensive measure against security bugs where an on-stack dynamic allocation isn't correctly size-checked (e.g. CVE-2021-3527). Signed-off-by: Peter Maydell Signed-off-by: Klaus Jensen --- hw/nvme/ctrl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'hw/nvme') diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c index d99a6f5..90687b1 100644 --- a/hw/nvme/ctrl.c +++ b/hw/nvme/ctrl.c @@ -894,7 +894,7 @@ static uint16_t nvme_map_prp(NvmeCtrl *n, NvmeSg *sg, uint64_t prp1, len -= trans_len; if (len) { if (len > n->page_size) { - uint64_t prp_list[n->max_prp_ents]; + g_autofree uint64_t *prp_list = g_new(uint64_t, n->max_prp_ents); uint32_t nents, prp_trans; int i = 0; -- cgit v1.1