[PATCH] gdbstub: Fix buffer overflow in handle_read_all_regs

[Damien Hedde]

Ensure we don't put too much register data in buffers. This avoids
a buffer overflow (and stack corruption) when a target has lots
of registers.

Signed-off-by: Damien Hedde <address@hidden>
---

Hi all,

While working on a target with many registers. I found out the gdbstub
may do buffer overflows when receiving a 'g' query (to read general
registers). This patch prevents that.

Gdb is pretty happy with a partial set of registers and queries
remaining registers one by one when needed.

Regards,
Damien
---
 gdbstub.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/gdbstub.c b/gdbstub.c
index 4cf8af365e..dde0cfe0fe 100644
--- a/gdbstub.c
+++ b/gdbstub.c
@@ -1810,8 +1810,17 @@ static void handle_read_all_regs(GdbCmdContext *gdb_ctx, 
void *user_ctx)
     cpu_synchronize_state(gdb_ctx->s->g_cpu);
     len = 0;
     for (addr = 0; addr < gdb_ctx->s->g_cpu->gdb_num_g_regs; addr++) {
-        len += gdb_read_register(gdb_ctx->s->g_cpu, gdb_ctx->mem_buf + len,
-                                 addr);
+        int size = gdb_read_register(gdb_ctx->s->g_cpu, gdb_ctx->mem_buf + len,
+                                     addr);
+        if (len + size > MAX_PACKET_LENGTH / 2) {
+            /*
+             * Prevent gdb_ctx->str_buf overflow in memtohex() below.
+             * As a consequence, send only the first registers content.
+             * Gdb will query remaining ones if/when needed.
+             */
+            break;
+        }
+        len += size;
     }
 
     memtohex(gdb_ctx->str_buf, gdb_ctx->mem_buf, len);
-- 
2.24.0