yannick.naumann/RT-Task-Generator-QEMU
1
0
Fork 0
forked from alwin.berger/FRET-qemu
Code Pull Requests Activity

hw/net/rocker: Avoid variable length array

Browse Source 
Replace an on-stack variable length array in of_dpa_ig() with
a g_autofree heap allocation.

The codebase has very few VLAs, and if we can get rid of them all we
can make the compiler error on new additions.  This is a defensive
measure against security bugs where an on-stack dynamic allocation
isn't correctly size-checked (e.g.  CVE-2021-3527).

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
This commit is contained in:
Peter Maydell 2023-08-24 16:32:22 +01:00 committed by Jason Wang
parent 2a6cb383e2
commit 1257065783
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
hw/net/rocker/rocker_of_dpa.c
View File

@ -1043,7 +1043,7 @@ static void of_dpa_flow_ig_tbl(OfDpaFlowContext *fc, uint32_t tbl_id)
static ssize_t of_dpa_ig(World *world, uint32_t pport, static ssize_t of_dpa_ig(World *world, uint32_t pport,
const struct iovec *iov, int iovcnt) const struct iovec *iov, int iovcnt)
{ {
struct iovec iov_copy[iovcnt + 2]; g_autofree struct iovec *iov_copy = g_new(struct iovec, iovcnt + 2);
OfDpaFlowContext fc = { OfDpaFlowContext fc = {
.of_dpa = world_private(world), .of_dpa = world_private(world),
.in_pport = pport, .in_pport = pport,