[Qemu-devel] [PATCH 3/8] usb: fix unbounded stack for ohci_td_pkt

[Peter Xu]

Suggested-by: Paolo Bonzini <address@hidden>
CC: Gerd Hoffmann <address@hidden>
Signed-off-by: Peter Xu <address@hidden>
---
 hw/usb/hcd-ohci.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/hw/usb/hcd-ohci.c b/hw/usb/hcd-ohci.c
index 17ed461..c3cd4e2 100644
--- a/hw/usb/hcd-ohci.c
+++ b/hw/usb/hcd-ohci.c
@@ -936,11 +936,11 @@ static int ohci_service_iso_td(OHCIState *ohci, struct 
ohci_ed *ed,
 #ifdef trace_event_get_state
 static void ohci_td_pkt(const char *msg, const uint8_t *buf, size_t len)
 {
+#define __TEMP_WIDTH (16)
     bool print16 = !!trace_event_get_state(TRACE_USB_OHCI_TD_PKT_SHORT);
     bool printall = !!trace_event_get_state(TRACE_USB_OHCI_TD_PKT_FULL);
-    const int width = 16;
     int i;
-    char tmp[3 * width + 1];
+    char tmp[3 * __TEMP_WIDTH + 1];
     char *p = tmp;
 
     if (!printall && !print16) {
@@ -948,7 +948,7 @@ static void ohci_td_pkt(const char *msg, const uint8_t 
*buf, size_t len)
     }
 
     for (i = 0; ; i++) {
-        if (i && (!(i % width) || (i == len))) {
+        if (i && (!(i % __TEMP_WIDTH) || (i == len))) {
             if (!printall) {
                 trace_usb_ohci_td_pkt_short(msg, tmp);
                 break;
@@ -963,6 +963,7 @@ static void ohci_td_pkt(const char *msg, const uint8_t 
*buf, size_t len)
 
         p += sprintf(p, " %.2x", buf[i]);
     }
+#undef __TEMP_WIDTH
 }
 #else
 static void ohci_td_pkt(const char *msg, const uint8_t *buf, size_t len)
-- 
2.4.3