diff mbox

[v2] hw/i386: fix unbounded stack for load_multiboot

Message ID 1457512210-2835-1-git-send-email-peterx@redhat.com
State New
Headers show

Commit Message

Peter Xu March 9, 2016, 8:30 a.m. UTC 
Use heap rather than stack for kcmdline.

Signed-off-by: Peter Xu <peterx@redhat.com>
---
 hw/i386/multiboot.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

Comments

Eduardo Habkost March 11, 2016, 6:34 p.m. UTC | #1 
On Wed, Mar 09, 2016 at 04:30:10PM +0800, Peter Xu wrote:
> Use heap rather than stack for kcmdline.
> 
> Signed-off-by: Peter Xu <peterx@redhat.com>

Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>

I believe it can go through the PC tree.
diff mbox

Patch

diff --git a/hw/i386/multiboot.c b/hw/i386/multiboot.c
index 9e164e6..ddc3780 100644
--- a/hw/i386/multiboot.c
+++ b/hw/i386/multiboot.c
@@ -158,6 +158,7 @@  int load_multiboot(FWCfgState *fw_cfg,
     uint8_t bootinfo[MBI_SIZE];
     uint8_t *mb_bootinfo_data;
     uint32_t cmdline_len;
+    char *kcmdline = NULL;
 
     /* Ok, let's see if it is a multiboot image.
        The header is 12x32bit long, so the latest entry may be 8192 - 48. */
@@ -324,10 +325,9 @@  int load_multiboot(FWCfgState *fw_cfg,
     }
 
     /* Commandline support */
-    char kcmdline[strlen(kernel_filename) + strlen(kernel_cmdline) + 2];
-    snprintf(kcmdline, sizeof(kcmdline), "%s %s",
-             kernel_filename, kernel_cmdline);
+    kcmdline = g_strdup_printf("%s %s", kernel_filename, kernel_cmdline);
     stl_p(bootinfo + MBI_CMDLINE, mb_add_cmdline(&mbs, kcmdline));
+    g_free(kcmdline);
 
     stl_p(bootinfo + MBI_BOOTLOADER, mb_add_bootloader(&mbs, bootloader_name));