liujunjie ad63c549ec qstring: Fix qstring_from_substr() not to provoke int overflow ... qstring_from_substr() parameters @start and @end are of type int. blkdebug_parse_filename(), blkverify_parse_filename(), nbd_parse_uri(), and qstring_from_str() pass @end values of type size_t or ptrdiff_t. Values exceeding INT_MAX get truncated, with possibly disastrous results. Such huge substrings seem unlikely, but we found one in a core dump, where "info tlb" executed via QMP's human-monitor-command apparently produced 35 GiB of output. Fix by changing the parameters size_t. Signed-off-by: liujunjie <liujunjie23@huawei.com> Message-Id: <20180724134339.17832-1-liujunjie23@huawei.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>		2018-07-28 09:09:58 +02:00
..
dispatch.h	qmp: Use QDict * instead of QObject * for response objects	2018-07-03 23:18:56 +02:00
json-lexer.h	include: Clean up includes	2016-02-23 12:43:05 +00:00
json-parser.h	Include qapi/qmp/qlist.h exactly where needed	2018-02-09 13:52:15 +01:00
json-streamer.h	include: Clean up includes	2016-02-23 12:43:05 +00:00
qbool.h	qobject: use a QObjectBase_ struct	2018-05-04 08:27:53 +02:00
qdict.h	block: Add block-specific QDict header	2018-06-15 14:49:44 +02:00
qerror.h	qmp: Eliminate silly QERR_QMP_* macros	2017-03-05 09:14:19 +01:00
qjson.h	qobject: New qdict_from_jsonf_nofail()	2018-07-03 23:18:56 +02:00
qlist.h	qobject: use a QObjectBase_ struct	2018-05-04 08:27:53 +02:00
qlit.h	qlit: add qobject_from_qlit()	2018-03-19 10:00:14 -05:00
qnull.h	qobject: Modify qobject_ref() to return obj	2018-05-04 08:27:53 +02:00
qnum.h	qobject: use a QObjectBase_ struct	2018-05-04 08:27:53 +02:00
qobject.h	qobject: Modify qobject_ref() to return obj	2018-05-04 08:27:53 +02:00
qstring.h	qstring: Fix qstring_from_substr() not to provoke int overflow	2018-07-28 09:09:58 +02:00