aboutsummaryrefslogtreecommitdiff
path: root/monitor/hmp-cmds.c
diff options
context:
space:
mode:
authorMarkus Armbruster <armbru@redhat.com>2023-01-09 20:03:06 +0100
committerMarkus Armbruster <armbru@redhat.com>2023-01-19 13:30:01 +0100
commit147c48791be34f3d28faa00b625780c881095be9 (patch)
tree26ac8735d0d48c452e62174d6de16c6399e38215 /monitor/hmp-cmds.c
parent49e56287cccfe8b5def4bc4916f367b9a0303161 (diff)
ui: Fix silent truncation of numeric keys in HMP sendkey
Keys are int. HMP sendkey assigns them from the value strtoul(), silently truncating values greater than INT_MAX. Fix to reject them. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Message-Id: <20230109190321.1056914-3-armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Diffstat (limited to 'monitor/hmp-cmds.c')
-rw-r--r--monitor/hmp-cmds.c8
1 files changed, 6 insertions, 2 deletions
diff --git a/monitor/hmp-cmds.c b/monitor/hmp-cmds.c
index ed78a87ddd..9947ff0b45 100644
--- a/monitor/hmp-cmds.c
+++ b/monitor/hmp-cmds.c
@@ -1549,8 +1549,12 @@ void hmp_sendkey(Monitor *mon, const QDict *qdict)
v = g_malloc0(sizeof(*v));
if (strstart(keys, "0x", NULL)) {
- char *endp;
- int value = strtoul(keys, &endp, 0);
+ const char *endp;
+ int value;
+
+ if (qemu_strtoi(keys, &endp, 0, &value) < 0) {
+ goto err_out;
+ }
assert(endp <= keys + keyname_len);
if (endp != keys + keyname_len) {
goto err_out;