[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH 24/43] semihosting: Bound length for semihost_sys_{read, write}
From: |
Richard Henderson |
Subject: |
[PATCH 24/43] semihosting: Bound length for semihost_sys_{read, write} |
Date: |
Sat, 30 Apr 2022 06:29:13 -0700 |
Fixes a minor bug in which a 64-bit guest on a 32-bit host could
truncate the length. This would only ever cause a problem if
there were no bits set in the low 32, so that it truncates to 0.
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
semihosting/guestfd.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
diff --git a/semihosting/guestfd.c b/semihosting/guestfd.c
index 42efd2c558..356b87453c 100644
--- a/semihosting/guestfd.c
+++ b/semihosting/guestfd.c
@@ -364,6 +364,14 @@ void semihost_sys_read(CPUState *cs,
gdb_syscall_complete_cb complete,
complete(cs, -1, EBADF);
return;
}
+ /*
+ * Bound length for 64-bit guests on 32-bit hosts, not overlowing ssize_t.
+ * Note the Linux kernel does this with MAX_RW_COUNT, so it's not a bad
+ * idea to do this unconditionally.
+ */
+ if (len > INT32_MAX) {
+ len = INT32_MAX;
+ }
switch (gf->type) {
case GuestFDGDB:
gdb_read(cs, complete, gf, buf, len);
@@ -410,6 +418,14 @@ void semihost_sys_write(CPUState *cs,
gdb_syscall_complete_cb complete,
if (!gf) {
goto ebadf;
}
+ /*
+ * Bound length for 64-bit guests on 32-bit hosts, not overlowing ssize_t.
+ * Note the Linux kernel does this with MAX_RW_COUNT, so it's not a bad
+ * idea to do this unconditionally.
+ */
+ if (len > INT32_MAX) {
+ len = INT32_MAX;
+ }
switch (gf->type) {
case GuestFDGDB:
gdb_write(cs, complete, gf, buf, len);
--
2.34.1
- [PATCH 10/43] semihosting: Adjust error checking in common_semi_cb, (continued)
- [PATCH 10/43] semihosting: Adjust error checking in common_semi_cb, Richard Henderson, 2022/04/30
- [PATCH 02/43] semihosting: Return failure from softmmu-uaccess.h functions, Richard Henderson, 2022/04/30
- [PATCH 11/43] semihosting: Move common-semi.h to include/semihosting/, Richard Henderson, 2022/04/30
- [PATCH 17/43] semihosting: Split out common_semi_has_synccache, Richard Henderson, 2022/04/30
- [PATCH 13/43] include/exec: Move gdb_stat and gdb_timeval to gdbstub.h, Richard Henderson, 2022/04/30
- [PATCH 25/43] semihosting: Split out semihost_sys_lseek, Richard Henderson, 2022/04/30
- [PATCH 12/43] include/exec: Move gdb open flags to gdbstub.h, Richard Henderson, 2022/04/30
- [PATCH 05/43] semihosting: Add target_strlen for softmmu-uaccess.h, Richard Henderson, 2022/04/30
- [PATCH 20/43] semihosting: Split out semihost_sys_open, Richard Henderson, 2022/04/30
- [PATCH 19/43] semihosting: Move GET_ARG/SET_ARG earlier in the file, Richard Henderson, 2022/04/30
- [PATCH 24/43] semihosting: Bound length for semihost_sys_{read, write},
Richard Henderson <=
- [PATCH 33/43] gdbstub: Widen gdb_syscall_complete_cb return value, Richard Henderson, 2022/04/30
- [PATCH 35/43] target/m68k: Make semihosting system only, Richard Henderson, 2022/04/30
- [PATCH 39/43] target/m68k: Remove EXCP_HALT_INSN, Richard Henderson, 2022/04/30
- [PATCH 09/43] semihosting: Return void from do_common_semihosting, Richard Henderson, 2022/04/30
- [PATCH 15/43] semihosting: Split is_64bit_semihosting per target, Richard Henderson, 2022/04/30
- [PATCH 14/43] semihosting: Use struct gdb_stat in common_semi_flen_cb, Richard Henderson, 2022/04/30
- [PATCH 22/43] semihosting: Split out semihost_sys_read, Richard Henderson, 2022/04/30
- [PATCH 21/43] semihosting: Split out semihost_sys_close, Richard Henderson, 2022/04/30
- [PATCH 26/43] semihosting: Split out semihost_sys_isatty, Richard Henderson, 2022/04/30
- [PATCH 27/43] semihosting: Split out semihost_sys_flen, Richard Henderson, 2022/04/30