From 046aba169bc21c08823cfbe8d4f3b4ad116ac676 Mon Sep 17 00:00:00 2001 From: Markus Armbruster Date: Tue, 14 May 2019 20:03:08 +0200 Subject: [PATCH] gdbstub: Reject invalid RLE repeat counts MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit "Debugging with GDB / Appendix E GDB Remote Serial Protocol / Overview" specifies "The printable characters '#' and '$' or with a numeric value greater than 126 must not be used." gdb_read_byte() only rejects values < 32. This is wrong. Impact depends on the caller: * gdb_handlesig() passes a char. Incorrectly accepts '#', '$' and '\127'. * gdb_chr_receive() passes an uint8_t. Additionally accepts characters with the most-significant bit set. Correct the validity check to match the specification. Signed-off-by: Markus Armbruster Reviewed-by: Philippe Mathieu-Daudé Message-Id: <20190514180311.16028-4-armbru@redhat.com> --- gdbstub.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/gdbstub.c b/gdbstub.c index d54abd17cc2..c41eb1de078 100644 --- a/gdbstub.c +++ b/gdbstub.c @@ -2064,7 +2064,11 @@ static void gdb_read_byte(GDBState *s, int ch) } break; case RS_GETLINE_RLE: - if (ch < ' ') { + /* + * Run-length encoding is explained in "Debugging with GDB / + * Appendix E GDB Remote Serial Protocol / Overview". + */ + if (ch < ' ' || ch == '#' || ch == '$' || ch > 126) { /* invalid RLE count encoding */ trace_gdbstub_err_invalid_repeat((uint8_t)ch); s->state = RS_GETLINE; -- 2.39.2