We are not currently bounding the search to the 1024 bytes
that we allocated, possibly overrunning the buffer.
Use softmmu_strlen_user to find the length and allocate the
correct size from the beginning.
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
char *softmmu_lock_user_string(CPUArchState *env, target_ulong addr)
{
- /* TODO: Make this something that isn't fixed size. */
- char *s = malloc(1024);
- size_t len = 0;
-
- if (!s) {
+ ssize_t len = softmmu_strlen_user(env, addr);
+ if (len < 0) {
return NULL;
}
- do {
- if (cpu_memory_rw_debug(env_cpu(env), addr++, s + len, 1, 0)) {
- free(s);
- return NULL;
- }
- } while (s[len++]);
- return s;
+ return softmmu_lock_user(env, addr, len + 1, true);
}
void softmmu_unlock_user(CPUArchState *env, void *p,