mirror of https://gitee.com/openkylin/qemu.git
qemu-char: Fix potential out of bounds access to local arrays
Latest gcc-4.8 supports a new option -fsanitize=address which activates
an AddressSanitizer. This AddressSanitizer stops the QEMU system emulation
very early because two character arrays of size 8 are potentially written
with 9 bytes.
Commit 6ea314d914
added the code.
There is no obvious reason why width or height could need 8 characters,
so reduce it to 7 characters which together with the terminating '\0'
fit into the arrays.
Cc: qemu-stable <qemu-stable@nongnu.org>
Signed-off-by: Stefan Weil <sw@weilnetz.de>
Reviewed-by: Alex Bennée <alex@bennee.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
This commit is contained in:
parent
4b351a0f21
commit
49aa4058ac
|
@ -2989,11 +2989,11 @@ QemuOpts *qemu_chr_parse_compat(const char *label, const char *filename)
|
|||
if (strstart(filename, "vc", &p)) {
|
||||
qemu_opt_set(opts, "backend", "vc");
|
||||
if (*p == ':') {
|
||||
if (sscanf(p+1, "%8[0-9]x%8[0-9]", width, height) == 2) {
|
||||
if (sscanf(p+1, "%7[0-9]x%7[0-9]", width, height) == 2) {
|
||||
/* pixels */
|
||||
qemu_opt_set(opts, "width", width);
|
||||
qemu_opt_set(opts, "height", height);
|
||||
} else if (sscanf(p+1, "%8[0-9]Cx%8[0-9]C", width, height) == 2) {
|
||||
} else if (sscanf(p+1, "%7[0-9]Cx%7[0-9]C", width, height) == 2) {
|
||||
/* chars */
|
||||
qemu_opt_set(opts, "cols", width);
|
||||
qemu_opt_set(opts, "rows", height);
|
||||
|
|
Loading…
Reference in New Issue