diff options
| author | Markus Armbruster <armbru@redhat.com> | 2022-12-01 13:11:28 +0100 |
|---|---|---|
| committer | Markus Armbruster <armbru@redhat.com> | 2022-12-19 16:21:56 +0100 |
| commit | 236aafa61c83d26cf9aa8b043ce92194f9be144b (patch) | |
| tree | ee012712b44a25278efdfe1db0286ff9a529b596 /hw | |
| parent | 0bcaaff8d80fd00537bb7963a9baeedb68ec2ad4 (diff) | |
| download | qemu-236aafa61c83d26cf9aa8b043ce92194f9be144b.zip qemu-236aafa61c83d26cf9aa8b043ce92194f9be144b.tar.gz qemu-236aafa61c83d26cf9aa8b043ce92194f9be144b.tar.bz2 | |
pci: Fix silent truncation of pcie_aer_inject_error argument
PCI AER error status is 32 bit. The HMP command supports both
symbolic and numeric error status: anything that isn't a known
symbolic value is parsed as number with strtol(). Issues:
* Empty argument yields value zero.
* Range errors from strtol() are ignored, value is UINT32_MAX.
* Values not representable in uint32_t are silently truncated.
Fix to reject such input by switching to strtoui().
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20221201121133.3813857-9-armbru@redhat.com>
Diffstat (limited to 'hw')
| -rw-r--r-- | hw/pci/pcie_aer.c | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/hw/pci/pcie_aer.c b/hw/pci/pcie_aer.c index eff62f3..58d2081 100644 --- a/hw/pci/pcie_aer.c +++ b/hw/pci/pcie_aer.c @@ -30,6 +30,7 @@ #include "hw/pci/pci_bus.h" #include "hw/pci/pcie_regs.h" #include "qapi/error.h" +#include "qemu/cutils.h" //#define DEBUG_PCIE #ifdef DEBUG_PCIE @@ -963,6 +964,7 @@ static int do_pcie_aer_inject_error(Monitor *mon, const char *id = qdict_get_str(qdict, "id"); const char *error_name; uint32_t error_status; + unsigned int num; bool correctable; PCIDevice *dev; PCIEAERErr err; @@ -983,14 +985,13 @@ static int do_pcie_aer_inject_error(Monitor *mon, error_name = qdict_get_str(qdict, "error_status"); if (pcie_aer_parse_error_string(error_name, &error_status, &correctable)) { - char *e = NULL; - error_status = strtoul(error_name, &e, 0); - correctable = qdict_get_try_bool(qdict, "correctable", false); - if (!e || *e != '\0') { + if (qemu_strtoui(error_name, NULL, 0, &num) < 0) { monitor_printf(mon, "invalid error status value. \"%s\"", error_name); return -EINVAL; } + error_status = num; + correctable = qdict_get_try_bool(qdict, "correctable", false); } err.status = error_status; err.source_id = pci_requester_id(dev); |