net_client_init() uses a variable length array to store the prefix of 'ipv6-net' parameter (e.g. if ipv6-net=fec0::0/64, the prefix is 'fec0::0'). Since the IPv6 prefix can be at most as long as an IPv6 address, we can use an array with fixed size equals to INET6_ADDRSTRLEN.
Signed-off-by: Stefano Garzarella <sgarz...@redhat.com> --- net/net.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/net.c b/net/net.c index f3a3c5444c..2e5f27e121 100644 --- a/net/net.c +++ b/net/net.c @@ -1118,7 +1118,7 @@ static int net_client_init(QemuOpts *opts, bool is_netdev, Error **errp) const char *ip6_net = qemu_opt_get(opts, "ipv6-net"); if (ip6_net) { - char buf[strlen(ip6_net) + 1]; + char buf[INET6_ADDRSTRLEN]; if (get_str_sep(buf, sizeof(buf), &ip6_net, '/') < 0) { /* Default 64bit prefix length. */ -- 2.20.1