qstring: Fix qstring_from_substr() not to provoke int overflow
qstring_from_substr() parameters @start and @end are of type int. blkdebug_parse_filename(), blkverify_parse_filename(), nbd_parse_uri(), and qstring_from_str() pass @end values of type size_t or ptrdiff_t. Values exceeding INT_MAX get truncated, with possibly disastrous results. Such huge substrings seem unlikely, but we found one in a core dump, where "info tlb" executed via QMP's human-monitor-command apparently produced 35 GiB of output. Fix by changing the parameters size_t. Signed-off-by: liujunjie <liujunjie23@huawei.com> Message-Id: <20180724134339.17832-1-liujunjie23@huawei.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
This commit is contained in:
parent
18a398f6a3
commit
ad63c549ec
@ -24,7 +24,7 @@ struct QString {
|
||||
|
||||
QString *qstring_new(void);
|
||||
QString *qstring_from_str(const char *str);
|
||||
QString *qstring_from_substr(const char *str, int start, int end);
|
||||
QString *qstring_from_substr(const char *str, size_t start, size_t end);
|
||||
size_t qstring_get_length(const QString *qstring);
|
||||
const char *qstring_get_str(const QString *qstring);
|
||||
const char *qstring_get_try_str(const QString *qstring);
|
||||
|
@ -37,7 +37,7 @@ size_t qstring_get_length(const QString *qstring)
|
||||
*
|
||||
* Return string reference
|
||||
*/
|
||||
QString *qstring_from_substr(const char *str, int start, int end)
|
||||
QString *qstring_from_substr(const char *str, size_t start, size_t end)
|
||||
{
|
||||
QString *qstring;
|
||||
|
||||
|
Loading…
Reference in New Issue
Block a user