david.venhoff/QEMU-Nyx-fork
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qemu-char: Fix potential out of bounds access to local arrays

Browse Source 
Latest gcc-4.8 supports a new option -fsanitize=address which activates
an AddressSanitizer. This AddressSanitizer stops the QEMU system emulation
very early because two character arrays of size 8 are potentially written
with 9 bytes.

Commit 6ea314d91439741e95772dfbab98b4135e04bebb added the code.

There is no obvious reason why width or height could need 8 characters,
so reduce it to 7 characters which together with the terminating '\0'
fit into the arrays.

Cc: qemu-stable <qemu-stable@nongnu.org>
Signed-off-by: Stefan Weil <sw@weilnetz.de>
Reviewed-by: Alex Bennée <alex@bennee.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
This commit is contained in:
Stefan Weil 2013-09-30 23:04:49 +02:00 committed by Michael Tokarev
parent 4b351a0f21
commit 49aa4058ac
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
qemu-char.c
View File

@ -2989,11 +2989,11 @@ QemuOpts *qemu_chr_parse_compat(const char *label, const char *filename)
if (strstart(filename, "vc", &p)) { if (strstart(filename, "vc", &p)) {
qemu_opt_set(opts, "backend", "vc"); qemu_opt_set(opts, "backend", "vc");
if (*p == ':') { if (*p == ':') {
if (sscanf(p+1, "%8[0-9]x%8[0-9]", width, height) == 2) { if (sscanf(p+1, "%7[0-9]x%7[0-9]", width, height) == 2) {
/* pixels */ /* pixels */
qemu_opt_set(opts, "width", width); qemu_opt_set(opts, "width", width);
qemu_opt_set(opts, "height", height); qemu_opt_set(opts, "height", height);
} else if (sscanf(p+1, "%8[0-9]Cx%8[0-9]C", width, height) == 2) { } else if (sscanf(p+1, "%7[0-9]Cx%7[0-9]C", width, height) == 2) {
/* chars */ /* chars */
qemu_opt_set(opts, "cols", width); qemu_opt_set(opts, "cols", width);
qemu_opt_set(opts, "rows", height); qemu_opt_set(opts, "rows", height);