diff options
| author | Peter Maydell <peter.maydell@linaro.org> | 2023-08-18 16:10:55 +0100 |
|---|---|---|
| committer | Marc-André Lureau <marcandre.lureau@redhat.com> | 2023-09-04 14:57:44 +0400 |
| commit | 1663ffb9157e3dc17d14741f6cd6c48bfffde9d0 (patch) | |
| tree | 0d126cccd878b43aca7f0dd734ac48814f217d7b | |
| parent | 9db018ac56119ee8e0a87a1a340276e4c8d86392 (diff) | |
| download | focaccia-qemu-1663ffb9157e3dc17d14741f6cd6c48bfffde9d0.tar.gz focaccia-qemu-1663ffb9157e3dc17d14741f6cd6c48bfffde9d0.zip | |
ui/spice-display: Avoid dynamic stack allocation
Use an autofree heap allocation instead of a variable-length array on the stack in qemu_spice_create_update(). The codebase has very few VLAs, and if we can get rid of them all we can make the compiler error on new additions. This is a defensive measure against security bugs where an on-stack dynamic allocation isn't correctly size-checked (e.g. CVE-2021-3527). Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20230818151057.1541189-2-peter.maydell@linaro.org>
| -rw-r--r-- | ui/spice-display.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/ui/spice-display.c b/ui/spice-display.c index 3f3f8013d8..0e2fbfb17c 100644 --- a/ui/spice-display.c +++ b/ui/spice-display.c @@ -189,7 +189,7 @@ static void qemu_spice_create_update(SimpleSpiceDisplay *ssd) { static const int blksize = 32; int blocks = DIV_ROUND_UP(surface_width(ssd->ds), blksize); - int dirty_top[blocks]; + g_autofree int *dirty_top = NULL; int y, yoff1, yoff2, x, xoff, blk, bw; int bpp = surface_bytes_per_pixel(ssd->ds); uint8_t *guest, *mirror; @@ -198,6 +198,7 @@ static void qemu_spice_create_update(SimpleSpiceDisplay *ssd) return; }; + dirty_top = g_new(int, blocks); for (blk = 0; blk < blocks; blk++) { dirty_top[blk] = -1; } |