imrcpan/freebsd
1
0 Fork 0
mirror of https://github.com/freebsd/freebsd-src.git synced 2026-10-28 11:25:21 +01:00
Code Issues Packages Projects Releases Wiki Activity

bhyve: fix integer overflow in qXfer packet parser

Browse Source 
doff + dlen overflows unsigned int when both values are close to UINT_MAX,
causing the wrong branch to execute and passing an unbounded length to
append_binary_data().  Rewrite the comparison to avoid the addition.

Reviewed by:	markj
Fixes:		f81cdf24ba ("bhyve: Add support for XML register definitions")
MFC after:	1 week
Differential Revision:	https://reviews.freebsd.org/D60847
This commit is contained in:
Osvaldo Janeri Filho authored and Mark Johnston committed 2026-10-19 18:53:53 +00:00
1 parent f2bba01921
commit 5ce0ab7355
1 file changed
+1 -1
Download Patch File Download Diff File Expand all files Collapse all files
usr.sbin/bhyve/gdb.c
+1 -1
View File
@@ -1841,7 +1841,7 @@ gdb_query(const uint8_t *data, size_t len)
start_packet();
if (doff >= xmllen) {
append_char('l');
} else if (doff + dlen >= xmllen) {
} else if (dlen >= xmllen - doff) {
append_char('l');
append_binary_data(xml + doff, xmllen - doff);
} else {