From 9e4fa091eeb29e2363712c886cc1e9ad78631887 Mon Sep 17 00:00:00 2001 From: =?utf8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Sun, 8 Apr 2018 11:59:33 -0300 Subject: [PATCH] gdbstub: fix off-by-one in gdb_handle_packet() MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit memtohex() adds an extra trailing NUL character. Reported-by: AddressSanitizer Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Stefan Hajnoczi Message-id: 20180408145933.1149-1-f4bug@amsat.org Signed-off-by: Peter Maydell (cherry picked from commit 9005774b27b6aa5e1c99d80bd59d5d048c2f7077) Signed-off-by: Michael Roth --- gdbstub.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/gdbstub.c b/gdbstub.c index 2a94030d3b6..ca8433e1b6c 100644 --- a/gdbstub.c +++ b/gdbstub.c @@ -515,6 +515,7 @@ static inline int tohex(int v) return v - 10 + 'a'; } +/* writes 2*len+1 bytes in buf */ static void memtohex(char *buf, const uint8_t *mem, int len) { int i, c; @@ -970,8 +971,8 @@ static int gdb_handle_packet(GDBState *s, const char *line_buf) const char *p; uint32_t thread; int ch, reg_size, type, res; - char buf[MAX_PACKET_LENGTH]; uint8_t mem_buf[MAX_PACKET_LENGTH]; + char buf[sizeof(mem_buf) + 1 /* trailing NUL */]; uint8_t *registers; target_ulong addr, len; -- 2.39.5