[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 09/13] semihosting: Fix handling of buffer in TARGET_SYS_TMPNAM
From: |
Alex Bennée |
Subject: |
[PULL 09/13] semihosting: Fix handling of buffer in TARGET_SYS_TMPNAM |
Date: |
Fri, 29 Jul 2022 10:19:39 +0100 |
From: Peter Maydell <peter.maydell@linaro.org>
The TARGET_SYS_TMPNAM implementation has two bugs spotted by
Coverity:
* confusion about whether 'len' has the length of the string
including or excluding the terminating NUL means we
lock_user() len bytes of memory but memcpy() len + 1 bytes
* In the error-exit cases we forget to free() the buffer
that asprintf() returned to us
Resolves: Coverity CID 1490285, 1490289
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20220719121110.225657-5-peter.maydell@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20220725140520.515340-10-alex.bennee@linaro.org>
diff --git a/semihosting/arm-compat-semi.c b/semihosting/arm-compat-semi.c
index d12288fc80..e741674238 100644
--- a/semihosting/arm-compat-semi.c
+++ b/semihosting/arm-compat-semi.c
@@ -504,16 +504,25 @@ void do_common_semihosting(CPUState *cs)
GET_ARG(1);
GET_ARG(2);
len = asprintf(&s, "/tmp/qemu-%x%02x", getpid(), (int)arg1 & 0xff);
+ if (len < 0) {
+ common_semi_set_ret(cs, -1);
+ break;
+ }
+
+ /* Allow for trailing NUL */
+ len++;
/* Make sure there's enough space in the buffer */
- if (len < 0 || len >= arg2) {
+ if (len > arg2) {
+ free(s);
common_semi_set_ret(cs, -1);
break;
}
p = lock_user(VERIFY_WRITE, arg0, len, 0);
if (!p) {
+ free(s);
goto do_fault;
}
- memcpy(p, s, len + 1);
+ memcpy(p, s, len);
unlock_user(p, arg0, len);
free(s);
common_semi_set_ret(cs, 0);
--
2.30.2
- [PULL 06/13] semihosting: Don't return negative values on qemu_semihosting_console_write() failure, (continued)
- [PULL 06/13] semihosting: Don't return negative values on qemu_semihosting_console_write() failure, Alex Bennée, 2022/07/29
- [PULL 02/13] gitlab: show testlog.txt contents when cirrus/custom-runner jobs fail, Alex Bennée, 2022/07/29
- [PULL 03/13] gitlab: drop 'containers-layer2' stage, Alex Bennée, 2022/07/29
- [PULL 01/13] tests: refresh to latest libvirt-ci module, Alex Bennée, 2022/07/29
- [PULL 08/13] semihosting: Check for errors on SET_ARG(), Alex Bennée, 2022/07/29
- [PULL 07/13] semihosting: Don't copy buffer after console_write(), Alex Bennée, 2022/07/29
- [PULL 12/13] docs/devel: fix description of OBJECT_DECLARE_SIMPLE_TYPE, Alex Bennée, 2022/07/29
- [PULL 10/13] qapi: Add exit-failure PanicAction, Alex Bennée, 2022/07/29
- [PULL 13/13] qemu-options: bring the kernel and image options together, Alex Bennée, 2022/07/29
- [PULL 11/13] tests/tcg/s390x: Test unaligned accesses to lowcore, Alex Bennée, 2022/07/29
- [PULL 09/13] semihosting: Fix handling of buffer in TARGET_SYS_TMPNAM,
Alex Bennée <=
- Re: [PULL 00/13] testing, semihosting and doc fixes, Richard Henderson, 2022/07/29