diff options
| author | Markus Armbruster <armbru@redhat.com> | 2023-01-09 20:03:06 +0100 |
|---|---|---|
| committer | Markus Armbruster <armbru@redhat.com> | 2023-01-19 13:30:01 +0100 |
| commit | 147c48791be34f3d28faa00b625780c881095be9 (patch) | |
| tree | 26ac8735d0d48c452e62174d6de16c6399e38215 | |
| parent | 49e56287cccfe8b5def4bc4916f367b9a0303161 (diff) | |
ui: Fix silent truncation of numeric keys in HMP sendkey
Keys are int. HMP sendkey assigns them from the value strtoul(),
silently truncating values greater than INT_MAX. Fix to reject them.
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-Id: <20230109190321.1056914-3-armbru@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
| -rw-r--r-- | monitor/hmp-cmds.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/monitor/hmp-cmds.c b/monitor/hmp-cmds.c index ed78a87ddd..9947ff0b45 100644 --- a/monitor/hmp-cmds.c +++ b/monitor/hmp-cmds.c @@ -1549,8 +1549,12 @@ void hmp_sendkey(Monitor *mon, const QDict *qdict) v = g_malloc0(sizeof(*v)); if (strstart(keys, "0x", NULL)) { - char *endp; - int value = strtoul(keys, &endp, 0); + const char *endp; + int value; + + if (qemu_strtoi(keys, &endp, 0, &value) < 0) { + goto err_out; + } assert(endp <= keys + keyname_len); if (endp != keys + keyname_len) { goto err_out; |