From: Prasad J Pandit <pjp@fedoraproject.org>
Date: Tue, 7 Mar 2017 07:21:47 +0000 (+0530)
Subject: linux-user: allocate heap memory for execve arguments
X-Git-Url: http://git.maquefel.me/?a=commitdiff_plain;h=b936cb50aacf3cccf5d2363095c6547eb709583a;p=qemu.git

linux-user: allocate heap memory for execve arguments

Arguments passed to execve(2) call from user program could
be large, allocating stack memory for them via alloca(3) call
would lead to bad behaviour. Use 'g_new0' to allocate memory
for such arguments.

Reported-by: Jann Horn <jannh@google.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Riku Voipio <riku.voipio@linaro.org>
---

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 32aba195c5..c8f6efc89c 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -7985,8 +7985,8 @@ abi_long do_syscall(void *cpu_env, int num, abi_long arg1,
                 envc++;
             }
 
-            argp = alloca((argc + 1) * sizeof(void *));
-            envp = alloca((envc + 1) * sizeof(void *));
+            argp = g_new0(char *, argc + 1);
+            envp = g_new0(char *, envc + 1);
 
             for (gp = guest_argp, q = argp; gp;
                   gp += sizeof(abi_ulong), q++) {
@@ -8047,6 +8047,9 @@ abi_long do_syscall(void *cpu_env, int num, abi_long arg1,
                     break;
                 unlock_user(*q, addr, 0);
             }
+
+            g_free(argp);
+            g_free(envp);
         }
         break;
     case TARGET_NR_chdir: