From ea6ea4313d21182a5ae37b301c0b215b07b28717 Mon Sep 17 00:00:00 2001 From: liujunjie Date: Thu, 2 Aug 2018 21:21:41 -0400 Subject: [PATCH] qstring: Fix qstring_from_substr() not to provoke int overflow qstring_from_substr() parameters @start and @end are of type int. blkdebug_parse_filename(), blkverify_parse_filename(), nbd_parse_uri(), and qstring_from_str() pass @end values of type size_t or ptrdiff_t. Values exceeding INT_MAX get truncated, with possibly disastrous results. Such huge substrings seem unlikely, but we found one in a core dump, where "info tlb" executed via QMP's human-monitor-command apparently produced 35 GiB of output. Fix by changing the parameters size_t. Backports commit ad63c549ecd4af4a22a675a815edeb06b0e7bb6e from qemu --- qemu/include/qapi/qmp/qstring.h | 2 +- qemu/qobject/qstring.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/qemu/include/qapi/qmp/qstring.h b/qemu/include/qapi/qmp/qstring.h index 0a563f87..f143f755 100644 --- a/qemu/include/qapi/qmp/qstring.h +++ b/qemu/include/qapi/qmp/qstring.h @@ -25,7 +25,7 @@ struct QString { QString *qstring_new(void); QString *qstring_from_str(const char *str); -QString *qstring_from_substr(const char *str, int start, int end); +QString *qstring_from_substr(const char *str, size_t start, size_t end); size_t qstring_get_length(const QString *qstring); const char *qstring_get_str(const QString *qstring); const char *qstring_get_try_str(const QString *qstring); diff --git a/qemu/qobject/qstring.c b/qemu/qobject/qstring.c index b4bee272..fcf4ba2b 100644 --- a/qemu/qobject/qstring.c +++ b/qemu/qobject/qstring.c @@ -37,7 +37,7 @@ size_t qstring_get_length(const QString *qstring) * * Return string reference */ -QString *qstring_from_substr(const char *str, int start, int end) +QString *qstring_from_substr(const char *str, size_t start, size_t end) { QString *qstring;