[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [PATCH] gdbstub: Fix buffer overflow in handle_read_all_regs
From: |
Luc Michel |
Subject: |
Re: [PATCH] gdbstub: Fix buffer overflow in handle_read_all_regs |
Date: |
Fri, 8 Nov 2019 14:40:02 +0100 |
User-agent: |
Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.2.2 |
On 11/8/19 1:55 PM, Damien Hedde wrote:
> Ensure we don't put too much register data in buffers. This avoids
> a buffer overflow (and stack corruption) when a target has lots
> of registers.
>
> Signed-off-by: Damien Hedde <address@hidden>
> ---
>
> Hi all,
>
> While working on a target with many registers. I found out the gdbstub
> may do buffer overflows when receiving a 'g' query (to read general
> registers). This patch prevents that.
>
> Gdb is pretty happy with a partial set of registers and queries
> remaining registers one by one when needed.
>
> Regards,
> Damien
> ---
> gdbstub.c | 13 +++++++++++--
> 1 file changed, 11 insertions(+), 2 deletions(-)
>
> diff --git a/gdbstub.c b/gdbstub.c
> index 4cf8af365e..dde0cfe0fe 100644
> --- a/gdbstub.c
> +++ b/gdbstub.c
> @@ -1810,8 +1810,17 @@ static void handle_read_all_regs(GdbCmdContext
> *gdb_ctx, void *user_ctx)
> cpu_synchronize_state(gdb_ctx->s->g_cpu);
> len = 0;
> for (addr = 0; addr < gdb_ctx->s->g_cpu->gdb_num_g_regs; addr++) {
> - len += gdb_read_register(gdb_ctx->s->g_cpu, gdb_ctx->mem_buf + len,
> - addr);
> + int size = gdb_read_register(gdb_ctx->s->g_cpu, gdb_ctx->mem_buf +
> len,
> + addr);
> + if (len + size > MAX_PACKET_LENGTH / 2) {
> + /*
> + * Prevent gdb_ctx->str_buf overflow in memtohex() below.
> + * As a consequence, send only the first registers content.
> + * Gdb will query remaining ones if/when needed.
> + */
I could not find this behaviour documented in the GDB remote protocol
documentation. However in the GDB source code (in process_g_packet() in
remote.c) :
/* If this is smaller than we guessed the 'g' packet would be,
update our records. A 'g' reply that doesn't include a register's
value implies either that the register is not available, or that
the 'p' packet must be used. */
So:
Reviewed-by: Luc Michel <address@hidden>
> + break;
> + }
> + len += size;
> }
>
> memtohex(gdb_ctx->str_buf, gdb_ctx->mem_buf, len);
>
- [PATCH] gdbstub: Fix buffer overflow in handle_read_all_regs, Damien Hedde, 2019/11/08
- Re: [PATCH] gdbstub: Fix buffer overflow in handle_read_all_regs,
Luc Michel <=
- Re: [PATCH] gdbstub: Fix buffer overflow in handle_read_all_regs, Alex Bennée, 2019/11/08
- Re: [PATCH] gdbstub: Fix buffer overflow in handle_read_all_regs, Damien Hedde, 2019/11/08
- Re: [PATCH] gdbstub: Fix buffer overflow in handle_read_all_regs, Damien Hedde, 2019/11/08
- Re: [PATCH] gdbstub: Fix buffer overflow in handle_read_all_regs, Alex Bennée, 2019/11/08
- Re: [PATCH] gdbstub: Fix buffer overflow in handle_read_all_regs, Damien Hedde, 2019/11/14
- Re: [PATCH] gdbstub: Fix buffer overflow in handle_read_all_regs, Alex Bennée, 2019/11/14
- Re: [PATCH] gdbstub: Fix buffer overflow in handle_read_all_regs, Damien Hedde, 2019/11/14