usb/hid: avoid dynamic stack allocation

Git-commit: 3f67e2e7f135b8be4117f3c2960e78d894feaa03
References: bsc#1186012, CVE-2021-3527

Use autofree heap allocation instead.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-Id: <20210503132915.2335822-2-kraxel@redhat.com>
Signed-off-by: Jose R Ziviani <jose.ziviani@suse.com>

diff --git a/hw/usb/dev-hid.c b/hw/usb/dev-hid.c
index 88492f26e64682f73978fa0358b7cf557b1b0e89..7f5762adb252a31f4c2f7b18bb6090c8b394de8f 100644 (file)
--- a/hw/usb/dev-hid.c
+++ b/hw/usb/dev-hid.c
@@ -667,7 +667,7 @@ static void usb_hid_handle_data(USBDevice *dev, USBPacket *p)
 {
     USBHIDState *us = USB_HID(dev);
     HIDState *hs = &us->hid;
-    uint8_t buf[p->iov.size];
+    g_autofree uint8_t *buf = g_malloc(p->iov.size);
     int len = 0;
 
     switch (p->pid) {

diff --git a/hw/usb/dev-wacom.c b/hw/usb/dev-wacom.c
index 8ed57b3b44444ad0e07e65ae0929b449bbd8e41e..022e44a758e3d458f0159c3b874efd5ec841e6ab 100644 (file)
--- a/hw/usb/dev-wacom.c
+++ b/hw/usb/dev-wacom.c
@@ -306,7 +306,7 @@ static void usb_wacom_handle_control(USBDevice *dev, USBPacket *p,
 static void usb_wacom_handle_data(USBDevice *dev, USBPacket *p)
 {
     USBWacomState *s = (USBWacomState *) dev;
-    uint8_t buf[p->iov.size];
+    g_autofree uint8_t *buf = g_malloc(p->iov.size);
     int len = 0;
 
     switch (p->pid) {