Skip to content
Snippets Groups Projects
  1. Jul 10, 2019
  2. Jul 05, 2019
  3. Jun 18, 2019
  4. Jun 12, 2019
  5. Jun 11, 2019
  6. May 28, 2019
  7. May 22, 2019
    • Markus Armbruster's avatar
      gdbstub: Fix misuse of isxdigit() · 33c846ef
      Markus Armbruster authored
      
      gdb_read_byte() passes its @ch argument to isxdigit().  Undefined
      behavior when the value is negative.  Two callers:
      
      * gdb_chr_receive() passes an uint8_t value.  Safe.
      
      * gdb_handlesig() a char value.  Unsafe.  Not a security issue,
        because the characters come from the gdb client, which is trusted.
      
      The obvious fix would be casting @ch to unsigned char.  But note that
      gdb_read_byte() already casts @ch to uint8_t in many places.  Uses of
      @ch without such a cast:
      
      (1) Compare to a character constant with == or !=
      
      (2) s->linesum += ch
      
      (3) Store ch or ch ^ 0x20 into s->line_buf[]
      
      (4) Check for invalid RLE count:
          ch < ' ' || ch == '#' || ch == '$' || ch > 126
      
      (5) Pass to isxdigit()
      
      (6) Pass to fromhex()
      
      Change the parameter type from int to uint8_t, and drop the now
      redundant casts.  Affects the above uses as follows:
      
      (1) No change: the character constants are all non-negative.
      
      (2) Effectively no change: we only ever use s->linesum & 0xff, and
          s->linesum is int.
      
      (3) No change: s->line_buf[] is char[].
      
      (4) No change.
      
      (5) Avoid undefined behavior.
      
      (6) No change: only reached when isxdigit(ch)
      
      Signed-off-by: default avatarMarkus Armbruster <armbru@redhat.com>
      Message-Id: <20190514180311.16028-5-armbru@redhat.com>
      33c846ef
    • Markus Armbruster's avatar
      gdbstub: Reject invalid RLE repeat counts · 046aba16
      Markus Armbruster authored
      
      "Debugging with GDB / Appendix E GDB Remote Serial Protocol /
      Overview" specifies "The printable characters '#' and '$' or with a
      numeric value greater than 126 must not be used."  gdb_read_byte()
      only rejects values < 32.  This is wrong.  Impact depends on the caller:
      
      * gdb_handlesig() passes a char.  Incorrectly accepts '#', '$' and
        '\127'.
      
      * gdb_chr_receive() passes an uint8_t.  Additionally accepts
        characters with the most-significant bit set.
      
      Correct the validity check to match the specification.
      
      Signed-off-by: default avatarMarkus Armbruster <armbru@redhat.com>
      Reviewed-by: default avatarPhilippe Mathieu-Daudé <philmd@redhat.com>
      Message-Id: <20190514180311.16028-4-armbru@redhat.com>
      046aba16
  8. Mar 26, 2019
  9. Feb 15, 2019
  10. Feb 13, 2019
  11. Feb 05, 2019
  12. Jan 29, 2019
  13. Jan 07, 2019
Loading