motorhead/qemu
1
0
Fork 0
mirror of https://github.com/Motorhead1991/qemu.git synced 2025-08-11 03:24:58 -06:00
Code Issues Projects Releases Packages Wiki Activity Actions

semihosting: Bound length for semihost_sys_{read,write}

Browse source 
Fixes a minor bug in which a 64-bit guest on a 32-bit host could
truncate the length.  This would only ever cause a problem if
there were no bits set in the low 32, so that it truncates to 0.

Reviewed-by: Luc Michel <lmichel@kalray.eu>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
This commit is contained in:
Richard Henderson 2022-04-29 12:15:14 -07:00
parent aa915bd0a6
commit 40f1219a8b
1 changed files with 16 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

16
semihosting/syscalls.c
View file

@ -283,6 +283,14 @@ void semihost_sys_close(CPUState *cs, gdb_syscall_complete_cb complete, int fd)
void semihost_sys_read_gf(CPUState *cs, gdb_syscall_complete_cb complete, void semihost_sys_read_gf(CPUState *cs, gdb_syscall_complete_cb complete,
GuestFD *gf, target_ulong buf, target_ulong len) GuestFD *gf, target_ulong buf, target_ulong len)
{ {
/*
* Bound length for 64-bit guests on 32-bit hosts, not overlowing ssize_t.
* Note the Linux kernel does this with MAX_RW_COUNT, so it's not a bad
* idea to do this unconditionally.
*/
if (len > INT32_MAX) {
len = INT32_MAX;
}
switch (gf->type) { switch (gf->type) {
case GuestFDGDB: case GuestFDGDB:
gdb_read(cs, complete, gf, buf, len); gdb_read(cs, complete, gf, buf, len);
@ -313,6 +321,14 @@ void semihost_sys_read(CPUState *cs, gdb_syscall_complete_cb complete,
void semihost_sys_write_gf(CPUState *cs, gdb_syscall_complete_cb complete, void semihost_sys_write_gf(CPUState *cs, gdb_syscall_complete_cb complete,
GuestFD *gf, target_ulong buf, target_ulong len) GuestFD *gf, target_ulong buf, target_ulong len)
{ {
/*
* Bound length for 64-bit guests on 32-bit hosts, not overlowing ssize_t.
* Note the Linux kernel does this with MAX_RW_COUNT, so it's not a bad
* idea to do this unconditionally.
*/
if (len > INT32_MAX) {
len = INT32_MAX;
}
switch (gf->type) { switch (gf->type) {
case GuestFDGDB: case GuestFDGDB:
gdb_write(cs, complete, gf, buf, len); gdb_write(cs, complete, gf, buf, len);