From 49aa4058ac6dd0081aaa45776f07c98df397ca5e Mon Sep 17 00:00:00 2001 From: Stefan Weil Date: Mon, 30 Sep 2013 23:04:49 +0200 Subject: qemu-char: Fix potential out of bounds access to local arrays MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Latest gcc-4.8 supports a new option -fsanitize=address which activates an AddressSanitizer. This AddressSanitizer stops the QEMU system emulation very early because two character arrays of size 8 are potentially written with 9 bytes. Commit 6ea314d91439741e95772dfbab98b4135e04bebb added the code. There is no obvious reason why width or height could need 8 characters, so reduce it to 7 characters which together with the terminating '\0' fit into the arrays. Cc: qemu-stable Signed-off-by: Stefan Weil Reviewed-by: Alex Bennée Signed-off-by: Michael Tokarev --- qemu-char.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'qemu-char.c') diff --git a/qemu-char.c b/qemu-char.c index f7f5464b67..6d393e6a1b 100644 --- a/qemu-char.c +++ b/qemu-char.c @@ -2989,11 +2989,11 @@ QemuOpts *qemu_chr_parse_compat(const char *label, const char *filename) if (strstart(filename, "vc", &p)) { qemu_opt_set(opts, "backend", "vc"); if (*p == ':') { - if (sscanf(p+1, "%8[0-9]x%8[0-9]", width, height) == 2) { + if (sscanf(p+1, "%7[0-9]x%7[0-9]", width, height) == 2) { /* pixels */ qemu_opt_set(opts, "width", width); qemu_opt_set(opts, "height", height); - } else if (sscanf(p+1, "%8[0-9]Cx%8[0-9]C", width, height) == 2) { + } else if (sscanf(p+1, "%7[0-9]Cx%7[0-9]C", width, height) == 2) { /* chars */ qemu_opt_set(opts, "cols", width); qemu_opt_set(opts, "rows", height); -- cgit v1.2.1