From 147c48791be34f3d28faa00b625780c881095be9 Mon Sep 17 00:00:00 2001 From: Markus Armbruster Date: Mon, 9 Jan 2023 20:03:06 +0100 Subject: [PATCH] ui: Fix silent truncation of numeric keys in HMP sendkey MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit Keys are int. HMP sendkey assigns them from the value strtoul(), silently truncating values greater than INT_MAX. Fix to reject them. Signed-off-by: Markus Armbruster Reviewed-by: Daniel P. Berrangé Message-Id: <20230109190321.1056914-3-armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé --- monitor/hmp-cmds.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/monitor/hmp-cmds.c b/monitor/hmp-cmds.c index ed78a87ddd..9947ff0b45 100644 --- a/monitor/hmp-cmds.c +++ b/monitor/hmp-cmds.c @@ -1549,8 +1549,12 @@ void hmp_sendkey(Monitor *mon, const QDict *qdict) v = g_malloc0(sizeof(*v)); if (strstart(keys, "0x", NULL)) { - char *endp; - int value = strtoul(keys, &endp, 0); + const char *endp; + int value; + + if (qemu_strtoi(keys, &endp, 0, &value) < 0) { + goto err_out; + } assert(endp <= keys + keyname_len); if (endp != keys + keyname_len) { goto err_out; -- 2.11.4.GIT