mirror of
https://github.com/yuzu-emu/unicorn.git
synced 2024-12-25 01:35:39 +00:00
ea6ea4313d
qstring_from_substr() parameters @start and @end are of type int. blkdebug_parse_filename(), blkverify_parse_filename(), nbd_parse_uri(), and qstring_from_str() pass @end values of type size_t or ptrdiff_t. Values exceeding INT_MAX get truncated, with possibly disastrous results. Such huge substrings seem unlikely, but we found one in a core dump, where "info tlb" executed via QMP's human-monitor-command apparently produced 35 GiB of output. Fix by changing the parameters size_t. Backports commit ad63c549ecd4af4a22a675a815edeb06b0e7bb6e from qemu
40 lines
1.1 KiB
C
40 lines
1.1 KiB
C
/*
|
|
* QString Module
|
|
*
|
|
* Copyright (C) 2009 Red Hat Inc.
|
|
*
|
|
* Authors:
|
|
* Luiz Capitulino <lcapitulino@redhat.com>
|
|
*
|
|
* This work is licensed under the terms of the GNU LGPL, version 2.1 or later.
|
|
* See the COPYING.LIB file in the top-level directory.
|
|
*/
|
|
|
|
#ifndef QSTRING_H
|
|
#define QSTRING_H
|
|
|
|
#include "unicorn/platform.h"
|
|
#include "qapi/qmp/qobject.h"
|
|
|
|
struct QString {
|
|
struct QObjectBase_ base;
|
|
char *string;
|
|
size_t length;
|
|
size_t capacity;
|
|
};
|
|
|
|
QString *qstring_new(void);
|
|
QString *qstring_from_str(const char *str);
|
|
QString *qstring_from_substr(const char *str, size_t start, size_t end);
|
|
size_t qstring_get_length(const QString *qstring);
|
|
const char *qstring_get_str(const QString *qstring);
|
|
const char *qstring_get_try_str(const QString *qstring);
|
|
const char *qobject_get_try_str(const QObject *qstring);
|
|
void qstring_append_int(QString *qstring, int64_t value);
|
|
void qstring_append(QString *qstring, const char *str);
|
|
void qstring_append_chr(QString *qstring, int c);
|
|
bool qstring_is_equal(const QObject *x, const QObject *y);
|
|
void qstring_destroy_obj(QObject *obj);
|
|
|
|
#endif /* QSTRING_H */
|