diff mbox series

[24/43] semihosting: Bound length for semihost_sys_{read, write}

Message ID 20220430132932.324018-25-richard.henderson@linaro.org
State New
Headers show
Series semihosting cleanup | expand

Commit Message

Richard Henderson April 30, 2022, 1:29 p.m. UTC 
Fixes a minor bug in which a 64-bit guest on a 32-bit host could
truncate the length.  This would only ever cause a problem if
there were no bits set in the low 32, so that it truncates to 0.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 semihosting/guestfd.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)
diff mbox series

Patch

diff --git a/semihosting/guestfd.c b/semihosting/guestfd.c
index 42efd2c558..356b87453c 100644
--- a/semihosting/guestfd.c
+++ b/semihosting/guestfd.c
@@ -364,6 +364,14 @@  void semihost_sys_read(CPUState *cs, gdb_syscall_complete_cb complete,
         complete(cs, -1, EBADF);
         return;
     }
+    /*
+     * Bound length for 64-bit guests on 32-bit hosts, not overlowing ssize_t.
+     * Note the Linux kernel does this with MAX_RW_COUNT, so it's not a bad
+     * idea to do this unconditionally.
+     */
+    if (len > INT32_MAX) {
+        len = INT32_MAX;
+    }
     switch (gf->type) {
     case GuestFDGDB:
         gdb_read(cs, complete, gf, buf, len);
@@ -410,6 +418,14 @@  void semihost_sys_write(CPUState *cs, gdb_syscall_complete_cb complete,
     if (!gf) {
         goto ebadf;
     }
+    /*
+     * Bound length for 64-bit guests on 32-bit hosts, not overlowing ssize_t.
+     * Note the Linux kernel does this with MAX_RW_COUNT, so it's not a bad
+     * idea to do this unconditionally.
+     */
+    if (len > INT32_MAX) {
+        len = INT32_MAX;
+    }
     switch (gf->type) {
     case GuestFDGDB:
         gdb_write(cs, complete, gf, buf, len);