commit d71c3d305980b38c6e6794da7401172ac0fec891
author Peter Maydell <peter.maydell@linaro.org> Fri Aug 18 16:58:45 2023 +0100
committer Peter Maydell <peter.maydell@linaro.org> Thu Sep 21 16:07:14 2023 +0100
tree d3e6b544bc9c40621f910a7fe0606e4e8e5fa918
parent 706a92fbfa3932020d232890d1caf648b8e9eff6

audio/jackaudio: Avoid dynamic stack allocation in qjack_client_init

Avoid a dynamic stack allocation in qjack_client_init(), by using
a g_autofree heap allocation instead.

(We stick with allocate + snprintf() because the JACK API requires
the name to be no more than its maximum size, so g_strdup_printf()
would require an extra truncation step.)

The codebase has very few VLAs, and if we can get rid of them all we
can make the compiler error on new additions.  This is a defensive
measure against security bugs where an on-stack dynamic allocation
isn't correctly size-checked (e.g.  CVE-2021-3527).

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
Reviewed-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
Message-id: 20230818155846.1651287-2-peter.maydell@linaro.org