ui: fix vc_chr_write call in text_console_do_init

In case the string doesn't fit into the buffer snprintf returns the size
it would need, so len can be larger than the buffer.  Fix this by simply
using g_strdup_printf() instead of a static buffer.

Reported-by: Wenxiang Qian <leonwxqian@gmail.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id: 20200701181801.27935-1-kraxel@redhat.com

diff --git a/ui/console.c b/ui/console.c
index 08f75c9bf6246cc379303fa21ba8f5a8c41569eb..0579be792f331cb94e5e7a2d8a2539e30a73c578 100644 (file)
--- a/ui/console.c
+++ b/ui/console.c
@@ -2184,12 +2184,12 @@ static void text_console_do_init(Chardev *chr, DisplayState *ds)
     text_console_resize(s);
 
     if (chr->label) {
-        char msg[128];
-        int len;
+        char *msg;
 
         s->t_attrib.bgcol = QEMU_COLOR_BLUE;
-        len = snprintf(msg, sizeof(msg), "%s console\r\n", chr->label);
-        vc_chr_write(chr, (uint8_t *)msg, len);
+        msg = g_strdup_printf("%s console\r\n", chr->label);
+        vc_chr_write(chr, (uint8_t *)msg, strlen(msg));
+        g_free(msg);
         s->t_attrib = s->t_attrib_default;
     }