aboutsummaryrefslogtreecommitdiff
path: root/hw/net/rocker
diff options
context:
space:
mode:
authorPeter Maydell <peter.maydell@linaro.org>2023-08-24 16:32:22 +0100
committerJason Wang <jasowang@redhat.com>2023-09-18 14:36:13 +0800
commit1257065783df26a83934195a5cd70f951ef9c51d (patch)
tree015128f91cd5c1d149f295dcbfe736bf77a85bef /hw/net/rocker
parent2a6cb383e2ec7224d8631c3c0a324bff469c9c64 (diff)
hw/net/rocker: Avoid variable length array
Replace an on-stack variable length array in of_dpa_ig() with a g_autofree heap allocation. The codebase has very few VLAs, and if we can get rid of them all we can make the compiler error on new additions. This is a defensive measure against security bugs where an on-stack dynamic allocation isn't correctly size-checked (e.g. CVE-2021-3527). Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
Diffstat (limited to 'hw/net/rocker')
-rw-r--r--hw/net/rocker/rocker_of_dpa.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/hw/net/rocker/rocker_of_dpa.c b/hw/net/rocker/rocker_of_dpa.c
index dfe4754469..5e16056be6 100644
--- a/hw/net/rocker/rocker_of_dpa.c
+++ b/hw/net/rocker/rocker_of_dpa.c
@@ -1043,7 +1043,7 @@ static void of_dpa_flow_ig_tbl(OfDpaFlowContext *fc, uint32_t tbl_id)
static ssize_t of_dpa_ig(World *world, uint32_t pport,
const struct iovec *iov, int iovcnt)
{
- struct iovec iov_copy[iovcnt + 2];
+ g_autofree struct iovec *iov_copy = g_new(struct iovec, iovcnt + 2);
OfDpaFlowContext fc = {
.of_dpa = world_private(world),
.in_pport = pport,