[Spice-devel] [PATCH spice-common] spice.proto: fix demarshaller crash with name message

Marc-André Lureau marcandre.lureau at gmail.com
Tue Mar 20 13:42:55 PDT 2012


It turned out the demarshaller wasn't allocating enough space to
memcpy the name. In order to take into account the size of a variable
array, it needs to be marked with the @end tag so that the
"extra_size" is added to the allocated memory.

It would be nice if the demarshaller would somehow fail if this wasn't
set explicitly, or do the right thing by default.

@end the name so that demarshaller
---
 spice.proto |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/spice.proto b/spice.proto
index e3feffa..513fe87 100644
--- a/spice.proto
+++ b/spice.proto
@@ -225,7 +225,7 @@ channel MainChannel : BaseChannel {
 
     message {
        uint32 name_len;
-       uint8 name[name_len];
+       uint8 name[name_len] @end;
     } name;
 
     message {
-- 
1.7.7.6



More information about the Spice-devel mailing list