From: Philippe Mathieu-Daudé <f4bug@amsat.org>
Date: Sun, 8 Apr 2018 14:59:33 +0000 (-0300)
Subject: gdbstub: fix off-by-one in gdb_handle_packet()
X-Git-Tag: v2.11.2~3
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=9e4fa091eeb29e2363712c886cc1e9ad78631887;p=thirdparty%2Fqemu.git

gdbstub: fix off-by-one in gdb_handle_packet()

memtohex() adds an extra trailing NUL character.

Reported-by: AddressSanitizer
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20180408145933.1149-1-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
(cherry picked from commit 9005774b27b6aa5e1c99d80bd59d5d048c2f7077)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
---

diff --git a/gdbstub.c b/gdbstub.c
index 2a94030d3b6..ca8433e1b6c 100644
--- a/gdbstub.c
+++ b/gdbstub.c
@@ -515,6 +515,7 @@ static inline int tohex(int v)
         return v - 10 + 'a';
 }
 
+/* writes 2*len+1 bytes in buf */
 static void memtohex(char *buf, const uint8_t *mem, int len)
 {
     int i, c;
@@ -970,8 +971,8 @@ static int gdb_handle_packet(GDBState *s, const char *line_buf)
     const char *p;
     uint32_t thread;
     int ch, reg_size, type, res;
-    char buf[MAX_PACKET_LENGTH];
     uint8_t mem_buf[MAX_PACKET_LENGTH];
+    char buf[sizeof(mem_buf) + 1 /* trailing NUL */];
     uint8_t *registers;
     target_ulong addr, len;