mirror of
https://github.com/yuzu-emu/unicorn.git
synced 2025-10-24 09:37:18 +00:00
qstring_from_substr() parameters @start and @end are of type int. blkdebug_parse_filename(), blkverify_parse_filename(), nbd_parse_uri(), and qstring_from_str() pass @end values of type size_t or ptrdiff_t. Values exceeding INT_MAX get truncated, with possibly disastrous results. Such huge substrings seem unlikely, but we found one in a core dump, where "info tlb" executed via QMP's human-monitor-command apparently produced 35 GiB of output. Fix by changing the parameters size_t. Backports commit ad63c549ecd4af4a22a675a815edeb06b0e7bb6e from qemu |
||
|---|---|---|
| .. | ||
| qbool.h | ||
| qdict.h | ||
| qerror.h | ||
| qjson.h | ||
| qlist.h | ||
| qlit.h | ||
| qnull.h | ||
| qnum.h | ||
| qobject.h | ||
| qstring.h | ||