diff options
| author | liujunjie <liujunjie23@huawei.com> | 2018-07-24 21:43:39 +0800 |
|---|---|---|
| committer | Markus Armbruster <armbru@redhat.com> | 2018-07-28 09:09:58 +0200 |
| commit | ad63c549ecd4af4a22a675a815edeb06b0e7bb6e (patch) | |
| tree | 53071d44635706a7d6f59a9fecb0bac63d98d13e /include/qapi | |
| parent | 18a398f6a39df4b08ff86ac0d38384193ca5f4cc (diff) | |
qstring: Fix qstring_from_substr() not to provoke int overflow
qstring_from_substr() parameters @start and @end are of type int.
blkdebug_parse_filename(), blkverify_parse_filename(), nbd_parse_uri(),
and qstring_from_str() pass @end values of type size_t or ptrdiff_t.
Values exceeding INT_MAX get truncated, with possibly disastrous
results.
Such huge substrings seem unlikely, but we found one in a core dump,
where "info tlb" executed via QMP's human-monitor-command apparently
produced 35 GiB of output.
Fix by changing the parameters size_t.
Signed-off-by: liujunjie <liujunjie23@huawei.com>
Message-Id: <20180724134339.17832-1-liujunjie23@huawei.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Diffstat (limited to 'include/qapi')
| -rw-r--r-- | include/qapi/qmp/qstring.h | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/include/qapi/qmp/qstring.h b/include/qapi/qmp/qstring.h index b3b3d444d2..3e83e3a95d 100644 --- a/include/qapi/qmp/qstring.h +++ b/include/qapi/qmp/qstring.h @@ -24,7 +24,7 @@ struct QString { QString *qstring_new(void); QString *qstring_from_str(const char *str); -QString *qstring_from_substr(const char *str, int start, int end); +QString *qstring_from_substr(const char *str, size_t start, size_t end); size_t qstring_get_length(const QString *qstring); const char *qstring_get_str(const QString *qstring); const char *qstring_get_try_str(const QString *qstring); |