This is an automated email from Gerrit.

Hsiangkai Wang ([email protected]) just uploaded a new patch set to Gerrit, 
which you can find at http://openocd.zylin.com/1337

-- gerrit

commit 628da49f40685fb8f906c635633086312538a72f
Author: Hsiangkai <[email protected]>
Date:   Thu Apr 18 19:24:45 2013 +0800

    gdb_server: fix memory overwritten as processing 'g' or 'p' packets
    
    As gdb_server uses gdb_str_to_target() to generate the response
    ascii string, it will append an additional null byte to the end
    due to sprintf() function. So, we need to preserve one more byte
    to the buffer used in gdb_str_to_target().
    
    Change-Id: I989e8f9b2b1311220a1d9d02d5311bc0400d42b1
    Signed-off-by: Hsiangkai <[email protected]>

diff --git a/src/server/gdb_server.c b/src/server/gdb_server.c
index 8316d56..72e48ca 100644
--- a/src/server/gdb_server.c
+++ b/src/server/gdb_server.c
@@ -1118,7 +1118,10 @@ static int gdb_get_registers_packet(struct connection 
*connection,
 
        assert(reg_packet_size > 0);
 
-       reg_packet = malloc(reg_packet_size);
+       /* Allocate one more byte to avoid memory corruption in 
gdb_str_to_target().
+        * gdb_str_to_target() will write null byte('\0') at the end of the 
output string.
+        * So, we need to preserve one byte space for the null byte. */
+       reg_packet = malloc(reg_packet_size + 1);
        reg_packet_p = reg_packet;
 
        for (i = 0; i < reg_list_size; i++) {
@@ -1225,7 +1228,10 @@ static int gdb_get_register_packet(struct connection 
*connection,
        if (!reg_list[reg_num]->valid)
                reg_list[reg_num]->type->get(reg_list[reg_num]);
 
-       reg_packet = malloc(DIV_ROUND_UP(reg_list[reg_num]->size, 8) * 2);
+       /* Allocate one more byte to avoid memory corruption in 
gdb_str_to_target().
+        * gdb_str_to_target() will write null byte('\0') at the end of the 
output string.
+        * So, we need to preserve one byte space for the null byte. */
+       reg_packet = malloc(DIV_ROUND_UP(reg_list[reg_num]->size, 8) * 2 + 1);
 
        gdb_str_to_target(target, reg_packet, reg_list[reg_num]);
 

-- 

------------------------------------------------------------------------------
Precog is a next-generation analytics platform capable of advanced
analytics on semi-structured data. The platform includes APIs for building
apps and a phenomenal toolset for data science. Developers can use
our toolset for easy data analysis & visualization. Get a free account!
http://www2.precog.com/precogplatform/slashdotnewsletter
_______________________________________________
OpenOCD-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openocd-devel

Reply via email to