qstring: Fix qstring_from_substr() not to provoke int overflow
commitad63c549ecd4af4a22a675a815edeb06b0e7bb6e
authorliujunjie <liujunjie23@huawei.com>
Tue, 24 Jul 2018 13:43:39 +0000 (24 21:43 +0800)
committerMarkus Armbruster <armbru@redhat.com>
Sat, 28 Jul 2018 07:09:58 +0000 (28 09:09 +0200)
tree53071d44635706a7d6f59a9fecb0bac63d98d13e
parent18a398f6a39df4b08ff86ac0d38384193ca5f4cc
qstring: Fix qstring_from_substr() not to provoke int overflow

qstring_from_substr() parameters @start and @end are of type int.
blkdebug_parse_filename(), blkverify_parse_filename(), nbd_parse_uri(),
and qstring_from_str() pass @end values of type size_t or ptrdiff_t.
Values exceeding INT_MAX get truncated, with possibly disastrous
results.

Such huge substrings seem unlikely, but we found one in a core dump,
where "info tlb" executed via QMP's human-monitor-command apparently
produced 35 GiB of output.

Fix by changing the parameters size_t.

Signed-off-by: liujunjie <liujunjie23@huawei.com>
Message-Id: <20180724134339.17832-1-liujunjie23@huawei.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
include/qapi/qmp/qstring.h
qobject/qstring.c