From 185951817dede3dfe4eb1c4c6d262607bee605ef Mon Sep 17 00:00:00 2001 From: Gerd Hoffmann Date: Wed, 1 Jul 2020 20:18:01 +0200 Subject: [PATCH] ui: fix vc_chr_write call in text_console_do_init In case the string doesn't fit into the buffer snprintf returns the size it would need, so len can be larger than the buffer. Fix this by simply using g_strdup_printf() instead of a static buffer. Reported-by: Wenxiang Qian Signed-off-by: Gerd Hoffmann Message-id: 20200701181801.27935-1-kraxel@redhat.com --- ui/console.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/ui/console.c b/ui/console.c index 08f75c9bf6..0579be792f 100644 --- a/ui/console.c +++ b/ui/console.c @@ -2184,12 +2184,12 @@ static void text_console_do_init(Chardev *chr, DisplayState *ds) text_console_resize(s); if (chr->label) { - char msg[128]; - int len; + char *msg; s->t_attrib.bgcol = QEMU_COLOR_BLUE; - len = snprintf(msg, sizeof(msg), "%s console\r\n", chr->label); - vc_chr_write(chr, (uint8_t *)msg, len); + msg = g_strdup_printf("%s console\r\n", chr->label); + vc_chr_write(chr, (uint8_t *)msg, strlen(msg)); + g_free(msg); s->t_attrib = s->t_attrib_default; } -- 2.11.4.GIT