unicorn/qemu/include/qapi
liujunjie ea6ea4313d
qstring: Fix qstring_from_substr() not to provoke int overflow
qstring_from_substr() parameters @start and @end are of type int.
blkdebug_parse_filename(), blkverify_parse_filename(), nbd_parse_uri(),
and qstring_from_str() pass @end values of type size_t or ptrdiff_t.
Values exceeding INT_MAX get truncated, with possibly disastrous
results.

Such huge substrings seem unlikely, but we found one in a core dump,
where "info tlb" executed via QMP's human-monitor-command apparently
produced 35 GiB of output.

Fix by changing the parameters size_t.

Backports commit ad63c549ecd4af4a22a675a815edeb06b0e7bb6e from qemu
2018-08-02 21:21:51 -04:00
..
qmp qstring: Fix qstring_from_substr() not to provoke int overflow 2018-08-02 21:21:51 -04:00
clone-visitor.h qapi: New QAPI_CLONE_MEMBERS() 2018-03-03 17:36:02 -05:00
dealloc-visitor.h qapi: Add new visit_free() function 2018-02-25 01:05:41 -05:00
error.h qapi: Move qapi-schema.json to qapi/, rename generated files 2018-03-09 11:35:11 -05:00
qobject-input-visitor.h qapi: merge QInt and QFloat in QNum 2018-03-03 18:16:28 -05:00
qobject-output-visitor.h qapi: merge QInt and QFloat in QNum 2018-03-03 18:16:28 -05:00
string-input-visitor.h string-input-visitor: Favor new visit_free() function 2018-02-25 01:08:04 -05:00
visitor-impl.h qapi: Use QNull for a more regular visit_type_null() 2018-03-07 16:50:16 -05:00
visitor.h qapi: Move qapi-schema.json to qapi/, rename generated files 2018-03-09 11:35:11 -05:00