diff mbox

[6/8] usb: fix unbounded stack for usb_mtp_add_str

Message ID 1457420446-25276-7-git-send-email-peterx@redhat.com (mailing list archive)
State New, archived
Headers show

Commit Message

Peter Xu March 8, 2016, 7 a.m. UTC 
Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
CC: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 hw/usb/dev-mtp.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

Comments

Gerd Hoffmann March 8, 2016, 8:10 a.m. UTC | #1 
>  static void usb_mtp_add_str(MTPData *data, const char *str)
>  {
> +#define __WSTR_LEN (256)
>      uint32_t len = strlen(str)+1;
> -    wchar_t wstr[len];
> +    wchar_t wstr[__WSTR_LEN];

I think we should g_malloc() here.

cheers,
  Gerd
Peter Xu March 9, 2016, 5:29 a.m. UTC | #2 
On Tue, Mar 08, 2016 at 09:10:44AM +0100, Gerd Hoffmann wrote:
> >  static void usb_mtp_add_str(MTPData *data, const char *str)
> >  {
> > +#define __WSTR_LEN (256)
> >      uint32_t len = strlen(str)+1;
> > -    wchar_t wstr[len];
> > +    wchar_t wstr[__WSTR_LEN];
> 
> I think we should g_malloc() here.

Agree. Will fix. Thanks.

Peter
diff mbox

Patch

diff --git a/hw/usb/dev-mtp.c b/hw/usb/dev-mtp.c
index e6dae2f..40fe26e 100644
--- a/hw/usb/dev-mtp.c
+++ b/hw/usb/dev-mtp.c
@@ -718,16 +718,20 @@  static void usb_mtp_add_wstr(MTPData *data, const wchar_t *str)
 
 static void usb_mtp_add_str(MTPData *data, const char *str)
 {
+#define __WSTR_LEN (256)
     uint32_t len = strlen(str)+1;
-    wchar_t wstr[len];
+    wchar_t wstr[__WSTR_LEN];
     size_t ret;
 
+    assert(len <= __WSTR_LEN);
+
     ret = mbstowcs(wstr, str, len);
     if (ret == -1) {
         usb_mtp_add_wstr(data, L"Oops");
     } else {
         usb_mtp_add_wstr(data, wstr);
     }
+#undef __WSTR_LEN
 }
 
 static void usb_mtp_add_time(MTPData *data, time_t time)