From b2a7d8633ff31ea97e7d4edc23af461a28a66d9d Mon Sep 17 00:00:00 2001 From: Peter Maydell Date: Thu, 24 Aug 2023 17:45:35 +0100 Subject: tests/qtest/netdev-socket: Avoid variable-length array in inet_get_free_port_multiple() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit We use a variable-length array in inet_get_free_port_multiple(). This is only test code called at the start of a test, so switch to a heap allocation instead. The codebase has very few VLAs, and if we can get rid of them all we can make the compiler error on new additions. This is a defensive measure against security bugs where an on-stack dynamic allocation isn't correctly size-checked (e.g. CVE-2021-3527). Signed-off-by: Peter Maydell Message-Id: <20230824164535.2652070-1-peter.maydell@linaro.org> Reviewed-by: Laurent Vivier Reviewed-by: Thomas Huth Reviewed-by: Philippe Mathieu-Daudé Signed-off-by: Thomas Huth --- tests/qtest/netdev-socket.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'tests/qtest') diff --git a/tests/qtest/netdev-socket.c b/tests/qtest/netdev-socket.c index 097abc0..8eed548 100644 --- a/tests/qtest/netdev-socket.c +++ b/tests/qtest/netdev-socket.c @@ -82,7 +82,7 @@ static int inet_get_free_port_socket_ipv6(int sock) static int inet_get_free_port_multiple(int nb, int *port, bool ipv6) { - int sock[nb]; + g_autofree int *sock = g_new(int, nb); int i; for (i = 0; i < nb; i++) { -- cgit v1.1