diff options
| author | Peter Maydell <peter.maydell@linaro.org> | 2023-08-24 16:32:23 +0100 |
|---|---|---|
| committer | Jason Wang <jasowang@redhat.com> | 2023-09-18 14:36:13 +0800 |
| commit | c4cf68198ea6081de64265a1e1c2620576a209a0 (patch) | |
| tree | b6be4468be6b57c068d80bdb317599ce1002b452 /net | |
| parent | 1257065783df26a83934195a5cd70f951ef9c51d (diff) | |
net/dump: Avoid variable length array
Use a g_autofree heap allocation instead of a variable length
array in dump_receive_iov().
The codebase has very few VLAs, and if we can get rid of them all we
can make the compiler error on new additions. This is a defensive
measure against security bugs where an on-stack dynamic allocation
isn't correctly size-checked (e.g. CVE-2021-3527).
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
Diffstat (limited to 'net')
| -rw-r--r-- | net/dump.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/dump.c b/net/dump.c index 7d05f16ca7..16073f2458 100644 --- a/net/dump.c +++ b/net/dump.c @@ -68,7 +68,7 @@ static ssize_t dump_receive_iov(DumpState *s, const struct iovec *iov, int cnt, int64_t ts; int caplen; size_t size = iov_size(iov, cnt) - offset; - struct iovec dumpiov[cnt + 1]; + g_autofree struct iovec *dumpiov = g_new(struct iovec, cnt + 1); /* Early return in case of previous error. */ if (s->fd < 0) { |