test-runner: Fix buffer overflow

The argv buffer allocated by alloca is only large enough to hold the
original argument list.  Additional arguments (such as --kernel) are
appended at the end, which results in the stack corruption.  Make sure
to allocate space for additional arguments.

tools/test-runner.c

@@ -284,7 +284,7 @@ static void start_qemu(void)
 			initcmd, cwd, verbose_out, test_dir_list, testargs,
 			getenv("PATH"));
 
-	argv = alloca(sizeof(qemu_argv));
+	argv = alloca(sizeof(qemu_argv) + sizeof(char *) * 5);
 	memcpy(argv, qemu_argv, sizeof(qemu_argv));
 
 	pos = (sizeof(qemu_argv) / sizeof(char *)) - 1;