[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [PATCH] block/vpc: Avoid dynamic stack allocation
From: |
Francisco Iglesias |
Subject: |
Re: [PATCH] block/vpc: Avoid dynamic stack allocation |
Date: |
Fri, 18 Aug 2023 10:39:42 +0200 |
User-agent: |
Mutt/1.10.1 (2018-07-13) |
On [2023 Aug 11] Fri 18:52:29, Peter Maydell wrote:
> From: Philippe Mathieu-Daudé <philmd@redhat.com>
>
> Use autofree heap allocation instead of variable-length array on the
> stack. Here we don't expect the bitmap size to be enormous, and
> since we're about to read/write it to disk the overhead of the
> allocation should be fine.
>
> The codebase has very few VLAs, and if we can get rid of them all we
> can make the compiler error on new additions. This is a defensive
> measure against security bugs where an on-stack dynamic allocation
> isn't correctly size-checked (e.g. CVE-2021-3527).
>
> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
> [PMM: expanded commit message]
> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
> ---
> block/vpc.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/block/vpc.c b/block/vpc.c
> index 3810a601a38..ceb87dd3d8e 100644
> --- a/block/vpc.c
> +++ b/block/vpc.c
> @@ -510,7 +510,7 @@ get_image_offset(BlockDriverState *bs, uint64_t offset,
> bool write, int *err)
> miss sparse read optimization, but it's not a problem in terms of
> correctness. */
> if (write && (s->last_bitmap_offset != bitmap_offset)) {
> - uint8_t bitmap[s->bitmap_size];
> + g_autofree uint8_t *bitmap = g_malloc(s->bitmap_size);
> int r;
>
> s->last_bitmap_offset = bitmap_offset;
> @@ -558,7 +558,7 @@ alloc_block(BlockDriverState *bs, int64_t offset)
> int64_t bat_offset;
> uint32_t index, bat_value;
> int ret;
> - uint8_t bitmap[s->bitmap_size];
> + g_autofree uint8_t *bitmap = g_malloc(s->bitmap_size);
>
> /* Check if sector_num is valid */
> if ((offset < 0) || (offset > bs->total_sectors * BDRV_SECTOR_SIZE)) {
> --
> 2.34.1
>
>