mirror of
https://gitlab.com/qemu-project/qemu
synced 2024-09-06 09:55:55 +00:00
![]() qstring_from_substr() parameters @start and @end are of type int. blkdebug_parse_filename(), blkverify_parse_filename(), nbd_parse_uri(), and qstring_from_str() pass @end values of type size_t or ptrdiff_t. Values exceeding INT_MAX get truncated, with possibly disastrous results. Such huge substrings seem unlikely, but we found one in a core dump, where "info tlb" executed via QMP's human-monitor-command apparently produced 35 GiB of output. Fix by changing the parameters size_t. Signed-off-by: liujunjie <liujunjie23@huawei.com> Message-Id: <20180724134339.17832-1-liujunjie23@huawei.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com> |
||
---|---|---|
.. | ||
qmp | ||
clone-visitor.h | ||
dealloc-visitor.h | ||
error.h | ||
opts-visitor.h | ||
qmp-event.h | ||
qobject-input-visitor.h | ||
qobject-output-visitor.h | ||
string-input-visitor.h | ||
string-output-visitor.h | ||
util.h | ||
visitor-impl.h | ||
visitor.h |