[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-trivial] [PULL 02/24] gdbstub: Fix buffer overflows in gdb_handle_
From: |
Michael Tokarev |
Subject: |
[Qemu-trivial] [PULL 02/24] gdbstub: Fix buffer overflows in gdb_handle_packet() |
Date: |
Fri, 6 Nov 2015 15:43:39 +0300 |
From: Kevin Wolf <address@hidden>
Some places in gdb_handle_packet() can get an arbitrary length (most
times directly from the client) and either didn't check it at all or
checked against the wrong value, potentially causing buffer overflows.
Cc: address@hidden
Signed-off-by: Kevin Wolf <address@hidden>
Signed-off-by: Michael Tokarev <address@hidden>
---
gdbstub.c | 18 ++++++++++++++++--
1 file changed, 16 insertions(+), 2 deletions(-)
diff --git a/gdbstub.c b/gdbstub.c
index d2c95b5..9c29aa0 100644
--- a/gdbstub.c
+++ b/gdbstub.c
@@ -956,6 +956,13 @@ static int gdb_handle_packet(GDBState *s, const char
*line_buf)
if (*p == ',')
p++;
len = strtoull(p, NULL, 16);
+
+ /* memtohex() doubles the required space */
+ if (len > MAX_PACKET_LENGTH / 2) {
+ put_packet (s, "E22");
+ break;
+ }
+
if (target_memory_rw_debug(s->g_cpu, addr, mem_buf, len, false) != 0) {
put_packet (s, "E14");
} else {
@@ -970,6 +977,12 @@ static int gdb_handle_packet(GDBState *s, const char
*line_buf)
len = strtoull(p, (char **)&p, 16);
if (*p == ':')
p++;
+
+ /* hextomem() reads 2*len bytes */
+ if (len > strlen(p) / 2) {
+ put_packet (s, "E22");
+ break;
+ }
hextomem(mem_buf, p, len);
if (target_memory_rw_debug(s->g_cpu, addr, mem_buf, len,
true) != 0) {
@@ -1107,7 +1120,8 @@ static int gdb_handle_packet(GDBState *s, const char
*line_buf)
cpu = find_cpu(thread);
if (cpu != NULL) {
cpu_synchronize_state(cpu);
- len = snprintf((char *)mem_buf, sizeof(mem_buf),
+ /* memtohex() doubles the required space */
+ len = snprintf((char *)mem_buf, sizeof(buf) / 2,
"CPU#%d [%s]", cpu->cpu_index,
cpu->halted ? "halted " : "running");
memtohex(buf, mem_buf, len);
@@ -1136,8 +1150,8 @@ static int gdb_handle_packet(GDBState *s, const char
*line_buf)
put_packet(s, "E01");
break;
}
- hextomem(mem_buf, p + 5, len);
len = len / 2;
+ hextomem(mem_buf, p + 5, len);
mem_buf[len++] = 0;
qemu_chr_be_write(s->mon_chr, mem_buf, len);
put_packet(s, "OK");
--
2.1.4
- [Qemu-trivial] [PULL 08/24] hw/input/tsc210x: Remove superfluous memset, (continued)
- [Qemu-trivial] [PULL 08/24] hw/input/tsc210x: Remove superfluous memset, Michael Tokarev, 2015/11/06
- [Qemu-trivial] [PULL 01/24] hw/acpi/aml-build: remove useless glib version check, Michael Tokarev, 2015/11/06
- [Qemu-trivial] [PULL 23/24] qemu-sockets: do not test path with access() before unlinking, Michael Tokarev, 2015/11/06
- [Qemu-trivial] [PULL 20/24] target-alpha: fix uninitialized variable, Michael Tokarev, 2015/11/06
- [Qemu-trivial] [PULL 17/24] qom/object: fix 2 comment typos, Michael Tokarev, 2015/11/06
- [Qemu-trivial] [PULL 11/24] hw/dma/pxa2xx: Remove superfluous memset, Michael Tokarev, 2015/11/06
- [Qemu-trivial] [PULL 16/24] configure: remove help string for 'vnc-tls' option, Michael Tokarev, 2015/11/06
- [Qemu-trivial] [PULL 02/24] gdbstub: Fix buffer overflows in gdb_handle_packet(),
Michael Tokarev <=
- [Qemu-trivial] [PULL 14/24] qxl: Use g_new() & friends where that makes obvious sense, Michael Tokarev, 2015/11/06
- [Qemu-trivial] [PULL 19/24] ivshmem-server: fix possible OVERRUN, Michael Tokarev, 2015/11/06
- [Qemu-trivial] [PULL 13/24] ui: Use g_new() & friends where that makes obvious sense, Michael Tokarev, 2015/11/06
- [Qemu-trivial] [PULL 03/24] hw/display/tcx: Remove superfluous OBJECT() typecasts, Michael Tokarev, 2015/11/06
- [Qemu-trivial] [PULL 24/24] tap-bsd: use user-specified tap device if it already exists, Michael Tokarev, 2015/11/06
- [Qemu-trivial] [PULL 21/24] exec: avoid unnecessary cacheline bounce on ram_list.mru_block, Michael Tokarev, 2015/11/06
- [Qemu-trivial] [PULL 18/24] pci-assign: do not test path with access() before opening, Michael Tokarev, 2015/11/06
- [Qemu-trivial] [PULL 07/24] xen: fix invalid assertion, Michael Tokarev, 2015/11/06
- [Qemu-trivial] [PULL 05/24] fix bad indentation in pcie_cap_slot_write_config(), Michael Tokarev, 2015/11/06
- [Qemu-trivial] [PULL 22/24] taget-ppc: Fix read access to IBAT registers higher than IBAT3, Michael Tokarev, 2015/11/06