From 64c1a5443528ac09d8cd50f365d6a2fb8375b90c Mon Sep 17 00:00:00 2001 From: Peter Maydell Date: Wed, 21 Feb 2024 17:26:36 +0100 Subject: [PATCH] meson: Enable -Wvla MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit QEMU has historically used variable length arrays only very rarely. Variable length arrays are a potential security issue where an on-stack dynamic allocation isn't correctly size-checked, especially when the size comes from the guest. (An example problem of this kind from the past is CVE-2021-3527). Forbidding them entirely is a defensive measure against further bugs of this kind. Enable -Wvla to prevent any new uses from sneaking into the codebase. Signed-off-by: Peter Maydell Message-ID: <20240125173211.1786196-3-peter.maydell@linaro.org> [thuth: rebased to current master branch] Reviewed-by: Philippe Mathieu-Daudé Tested-by: Philippe Mathieu-Daudé Message-ID: <20240221162636.173136-4-thuth@redhat.com> Signed-off-by: Thomas Huth --- meson.build | 1 + 1 file changed, 1 insertion(+) diff --git a/meson.build b/meson.build index c1dc83e4c0..0ef1654e86 100644 --- a/meson.build +++ b/meson.build @@ -592,6 +592,7 @@ warn_flags = [ '-Wstrict-prototypes', '-Wtype-limits', '-Wundef', + '-Wvla', '-Wwrite-strings', # Then disable some undesirable warnings