Hello, +-- On Tue, 13 Oct 2015, P J P wrote --+ | Below is a proposed patch to fix this issue. | | === | > From 88edb457a66f8ff96209a1603914171eade0658b Mon Sep 17 00:00:00 2001 | From: Prasad J Pandit <p...@fedoraproject.org> | Date: Mon, 12 Oct 2015 22:56:41 +0530 | Subject: Limit memory r/w length to buffer size | | GDB(1) stub communication protocol supports commands m/M to read | and write 'len' bytes from/to the stub memory area. | | m addr,len : read 'len' bytes from address 'addr' | M addr,len:<data> : write 'len' bytes of 'data' to 'addr' | | Qemu stub uses automatic buffers of size 'MAX_PACKET_LENGTH=4096' | to process these commands. Limit 'len' parameter value supplied | by the host gdb(1) to the maximum buffer size to avoid any OOB | buffer access. | | Reported-by: Gerben van der Lubbe <spoofedexiste...@gmail.com> | Signed-off-by: Prasad J Pandit <p...@fedoraproject.org> | --- | gdbstub.c | 2 ++ | 1 file changed, 2 insertions(+)
Could someone review it please? Thank you. -- Prasad J Pandit / Red Hat Product Security Team 47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F
