sys64738
/
blackmagic
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Add range checking on mem access packets.

This commit is contained in:
Gareth McMullin 2017-04-18 11:41:11 +12:00
parent e5395aaba7
commit bd2cfe72f0
1 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
src/gdb_main.c
View File

@ -115,6 +115,10 @@ int gdb_main_loop(struct target_controller *tc, bool in_syscall)
uint32_t addr, len;
ERROR_IF_NO_TARGET();
sscanf(pbuf, "m%" SCNx32 ",%" SCNx32, &addr, &len);
if (len > sizeof(pbuf) / 2) {
gdb_putpacketz("E02");
break;
}
DEBUG("m packet: addr = %" PRIx32 ", len = %" PRIx32 "\n", addr, len);
uint8_t mem[len];
if (target_mem_read(cur_target, mem, addr, len))
@ -136,6 +140,10 @@ int gdb_main_loop(struct target_controller *tc, bool in_syscall)
int hex;
ERROR_IF_NO_TARGET();
sscanf(pbuf, "M%" SCNx32 ",%" SCNx32 ":%n", &addr, &len, &hex);
if (len > (unsigned)(size - hex) / 2) {
gdb_putpacketz("E02");
break;
}
DEBUG("M packet: addr = %" PRIx32 ", len = %" PRIx32 "\n", addr, len);
uint8_t mem[len];
unhexify(mem, pbuf + hex, len);
@ -251,6 +259,10 @@ int gdb_main_loop(struct target_controller *tc, bool in_syscall)
int bin;
ERROR_IF_NO_TARGET();
sscanf(pbuf, "X%" SCNx32 ",%" SCNx32 ":%n", &addr, &len, &bin);
if (len > (unsigned)(size - bin)) {
gdb_putpacketz("E02");
break;
}
DEBUG("X packet: addr = %" PRIx32 ", len = %" PRIx32 "\n", addr, len);
if (target_mem_write(cur_target, addr, pbuf+bin, len))
gdb_putpacketz("E01");