unicorn/qemu/qobject
liujunjie ea6ea4313d
qstring: Fix qstring_from_substr() not to provoke int overflow
qstring_from_substr() parameters @start and @end are of type int.
blkdebug_parse_filename(), blkverify_parse_filename(), nbd_parse_uri(),
and qstring_from_str() pass @end values of type size_t or ptrdiff_t.
Values exceeding INT_MAX get truncated, with possibly disastrous
results.

Such huge substrings seem unlikely, but we found one in a core dump,
where "info tlb" executed via QMP's human-monitor-command apparently
produced 35 GiB of output.

Fix by changing the parameters size_t.

Backports commit ad63c549ecd4af4a22a675a815edeb06b0e7bb6e from qemu
2018-08-02 21:21:51 -04:00
..
Makefile.objs qlit: move qlit from check-qjson to qobject/ 2018-03-07 17:08:17 -05:00
qbool.c qapi: Remove qobject_to_X() functions 2018-03-20 10:58:44 -04:00
qdict.c qobject: Modify qobject_ref() to return obj 2018-05-04 10:24:10 -04:00
qlist.c qobject: Replace qobject_incref/QINCREF qobject_decref/QDECREF 2018-05-04 10:16:07 -04:00
qlit.c qapi: Replace qobject_to_X(o) by qobject_to(X, o) 2018-03-20 10:55:57 -04:00
qnull.c qapi: Add qobject_is_equal() 2018-03-08 08:41:43 -05:00
qnum.c qapi: Remove qobject_to_X() functions 2018-03-20 10:58:44 -04:00
qobject.c qobject: use a QObjectBase_ struct 2018-05-04 10:11:24 -04:00
qstring.c qstring: Fix qstring_from_substr() not to provoke int overflow 2018-08-02 21:21:51 -04:00