[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH 7/8] migration: fix unbounded stack for source_r
From: |
Peter Xu |
Subject: |
Re: [Qemu-devel] [PATCH 7/8] migration: fix unbounded stack for source_return_path_thread |
Date: |
Wed, 9 Mar 2016 13:27:43 +0800 |
User-agent: |
Mutt/1.5.24 (2015-08-30) |
On Tue, Mar 08, 2016 at 01:26:24PM +0100, Paolo Bonzini wrote:
>
>
> On 08/03/2016 08:00, Peter Xu wrote:
> > Suggested-by: Paolo Bonzini <address@hidden>
> > CC: Juan Quintela <address@hidden>
> > CC: Amit Shah <address@hidden>
> > Signed-off-by: Peter Xu <address@hidden>
> > ---
> > migration/migration.c | 7 ++++---
> > 1 file changed, 4 insertions(+), 3 deletions(-)
> >
> > diff --git a/migration/migration.c b/migration/migration.c
> > index 0129d9f..f1a3976 100644
> > --- a/migration/migration.c
> > +++ b/migration/migration.c
> > @@ -1265,11 +1265,11 @@ static void
> > migrate_handle_rp_req_pages(MigrationState *ms, const char* rbname,
> > */
> > static void *source_return_path_thread(void *opaque)
> > {
> > +#define __MAX_LEN (512)
> > MigrationState *ms = opaque;
> > QEMUFile *rp = ms->rp_state.from_dst_file;
> > uint16_t header_len, header_type;
> > - const int max_len = 512;
> > - uint8_t buf[max_len];
> > + uint8_t buf[__MAX_LEN];
> > uint32_t tmp32, sibling_error;
> > ram_addr_t start = 0; /* =0 to silence warning */
> > size_t len = 0, expected_len;
> > @@ -1292,7 +1292,7 @@ static void *source_return_path_thread(void *opaque)
> >
> > if ((rp_cmd_args[header_type].len != -1 &&
> > header_len != rp_cmd_args[header_type].len) ||
> > - header_len > max_len) {
> > + header_len > __MAX_LEN) {
> > error_report("RP: Received '%s' message (0x%04x) with"
> > "incorrect length %d expecting %zu",
> > rp_cmd_args[header_type].name, header_type, header_len,
> > @@ -1372,6 +1372,7 @@ out:
> > ms->rp_state.from_dst_file = NULL;
> > qemu_fclose(rp);
> > return NULL;
> > +#undef __MAX_LEN
> > }
> >
> > static int open_return_path_on_source(MigrationState *ms)
> >
>
> Another compiler false positive that you can fix with ARRAY_SIZE.
Yes, will fix.
Thanks.
Peter
- Re: [Qemu-devel] [PATCH 5/8] usb: fix unbounded stack for inotify_watchfn, (continued)