Commit c826f7d25c for qemu.org

commit c826f7d25c09e98b097f3789c4905dace8eccce9
Author: Marc-André Lureau <marcandre.lureau@redhat.com>
Date:   Sun Oct 4 14:23:19 2026 +0400

    audio/paaudio: avoid pidfile path truncation

    The pidfile path is built with snprintf() into a 64-byte stack buffer,
    which can silently truncate when XDG_RUNTIME_DIR is long. Use
    g_strdup_printf() with g_autofree instead.

    Reported-by: Hui Peng <benquike@gmail.com>
    Fixes: d175505bd68d ("audio: check for pulseaudio daemon pidfile")
    Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
    Message-ID: <20261004-issue-4560-v1-5-ccbef537cbeb@redhat.com>

diff --git a/audio/paaudio.c b/audio/paaudio.c
index 9d0a622fc5..358595c046 100644
--- a/audio/paaudio.c
+++ b/audio/paaudio.c
@@ -819,7 +819,7 @@ audio_pa_realize(AudioBackend *abe, Audiodev *dev, Error **errp)
     }

     if (!popts->server) {
-        char pidfile[64];
+        g_autofree char *pidfile = NULL;
         char *runtime;
         struct stat st;

@@ -828,7 +828,7 @@ audio_pa_realize(AudioBackend *abe, Audiodev *dev, Error **errp)
             error_setg(errp, "XDG_RUNTIME_DIR not set");
             return false;
         }
-        snprintf(pidfile, sizeof(pidfile), "%s/pulse/pid", runtime);
+        pidfile = g_strdup_printf("%s/pulse/pid", runtime);
         if (stat(pidfile, &st) != 0) {
             error_setg_errno(errp, errno, "could not stat pidfile %s", pidfile);
             return false;