diff mbox series

[PULL,V2,16/17] net/dump: Avoid variable length array

Message ID 20230918083132.55423-17-jasowang@redhat.com
State New
Headers show
Series [PULL,V2,01/17] tap: Add USO support to tap device. | expand

Commit Message

Jason Wang Sept. 18, 2023, 8:31 a.m. UTC 
From: Peter Maydell <peter.maydell@linaro.org>

Use a g_autofree heap allocation instead of a variable length
array in dump_receive_iov().

The codebase has very few VLAs, and if we can get rid of them all we
can make the compiler error on new additions.  This is a defensive
measure against security bugs where an on-stack dynamic allocation
isn't correctly size-checked (e.g.  CVE-2021-3527).

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/dump.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/net/dump.c b/net/dump.c
index 7d05f16..16073f2 100644
--- a/net/dump.c
+++ b/net/dump.c
@@ -68,7 +68,7 @@  static ssize_t dump_receive_iov(DumpState *s, const struct iovec *iov, int cnt,
     int64_t ts;
     int caplen;
     size_t size = iov_size(iov, cnt) - offset;
-    struct iovec dumpiov[cnt + 1];
+    g_autofree struct iovec *dumpiov = g_new(struct iovec, cnt + 1);
 
     /* Early return in case of previous error. */
     if (s->fd < 0) {