[Spice-devel] [PATCH spice-common] spice.proto: fix demarshaller crash with name message

Hans de Goede hdegoede at redhat.com
Tue Mar 20 14:48:01 PDT 2012


Ack.

On 03/20/2012 09:42 PM, Marc-André Lureau wrote:
> It turned out the demarshaller wasn't allocating enough space to
> memcpy the name. In order to take into account the size of a variable
> array, it needs to be marked with the @end tag so that the
> "extra_size" is added to the allocated memory.
>
> It would be nice if the demarshaller would somehow fail if this wasn't
> set explicitly, or do the right thing by default.
>
> @end the name so that demarshaller
> ---
>   spice.proto |    2 +-
>   1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/spice.proto b/spice.proto
> index e3feffa..513fe87 100644
> --- a/spice.proto
> +++ b/spice.proto
> @@ -225,7 +225,7 @@ channel MainChannel : BaseChannel {
>
>       message {
>          uint32 name_len;
> -       uint8 name[name_len];
> +       uint8 name[name_len] @end;
>       } name;
>
>       message {


More information about the Spice-devel mailing list