From: Jack Lange <jacklange@cs.pitt.edu>
Date: Thu, 3 Nov 2011 22:46:39 +0000 (-0400)
Subject: fixed stack overflow bug in curses console framebuffer
X-Git-Url: http://v3vee.org/palacios/gitweb/gitweb.cgi?a=commitdiff_plain;h=e9fc46a873dfb004c61cb1f245420e7ebcfad575;p=palacios.git

fixed stack overflow bug in curses console framebuffer
---

diff --git a/palacios/src/devices/curses_cons.c b/palacios/src/devices/curses_cons.c
index e71cb51..1447bd5 100644
--- a/palacios/src/devices/curses_cons.c
+++ b/palacios/src/devices/curses_cons.c
@@ -42,6 +42,7 @@ struct cons_state {
     v3_console_t cons;
     int rows;
     int cols;
+    uint8_t * framebuf;
     struct vm_device * frontend_dev;
 };
 
@@ -90,23 +91,27 @@ static int screen_update(uint_t x, uint_t y, uint_t length, void * private_data)
     struct vm_device * dev = (struct vm_device *)private_data;
     struct cons_state * state = (struct cons_state *)dev->private_data;
     uint_t offset = (x + y * state->cols) * BYTES_PER_COL;
-    uint8_t fb_buf[length];
     int i;
     uint_t cur_x = x;
     uint_t cur_y = y;
     
+    if (length > (state->rows * state->cols * BYTES_PER_COL)) {
+	PrintError("Screen update larger than curses framebuffer\n");
+	return 0;
+    }
+
     PrintDebug("screen_update(%d, %d, %d, %p)\n", x, y, length, private_data);
 
     /* grab frame buffer */
-    v3_cons_get_fb(state->frontend_dev, fb_buf, offset, length);
+    v3_cons_get_fb(state->frontend_dev, state->framebuf, offset, length);
     
     /* update the screen */
     for (i = 0; i < length; i += 2) {
 	uint_t col_index = i;
 	uint8_t col[2];
 	
-	col[0] = fb_buf[col_index];     // Character
-	col[1] = fb_buf[col_index + 1]; // Attribute
+	col[0] = state->framebuf[col_index];     // Character
+	col[1] = state->framebuf[col_index + 1]; // Attribute
 	
 	/* update current character */
 	if (v3_console_set_char(state->cons, cur_x, cur_y, col[0], col[1]) < 0) {
@@ -228,6 +233,8 @@ static int cons_init(struct v3_vm_info * vm, v3_cfg_tree_t * cfg)
     state->frontend_dev = frontend;
     state->cols = 80;
     state->rows = 25;
+    state->framebuf = V3_Malloc(state->cols * state->rows * BYTES_PER_COL);
+
 
     /* open tty for screen display */
     state->cons = v3_console_open(vm, state->cols, state->rows);