ui: fix vc_chr_write call in text_console_do_init

In case the string doesn't fit into the buffer snprintf returns the size
it would need, so len can be larger than the buffer.  Fix this by simply
using g_strdup_printf() instead of a static buffer.

Reported-by: Wenxiang Qian <leonwxqian@gmail.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id: 20200701181801.27935-1-kraxel@redhat.com
This commit is contained in:
Gerd Hoffmann 2020-07-01 20:18:01 +02:00
parent 480324ec8d
commit 185951817d

View file

@ -2184,12 +2184,12 @@ static void text_console_do_init(Chardev *chr, DisplayState *ds)
text_console_resize(s);
if (chr->label) {
char msg[128];
int len;
char *msg;
s->t_attrib.bgcol = QEMU_COLOR_BLUE;
len = snprintf(msg, sizeof(msg), "%s console\r\n", chr->label);
vc_chr_write(chr, (uint8_t *)msg, len);
msg = g_strdup_printf("%s console\r\n", chr->label);
vc_chr_write(chr, (uint8_t *)msg, strlen(msg));
g_free(msg);
s->t_attrib = s->t_attrib_default;
}