aboutsummaryrefslogtreecommitdiff
path: root/semihosting
diff options
context:
space:
mode:
authorPeter Maydell <peter.maydell@linaro.org>2022-07-25 15:05:16 +0100
committerAlex Bennée <alex.bennee@linaro.org>2022-07-29 09:48:01 +0100
commit9b1268f55ceb0d9390a051cad299b3021dfa9896 (patch)
treeb98e804a30e5ab6677c062284b1af70634de01ad /semihosting
parentfed49cdf6a721d76f9ac1cf76fd05b3fbd8b4892 (diff)
downloadqemu-9b1268f55ceb0d9390a051cad299b3021dfa9896.zip
qemu-9b1268f55ceb0d9390a051cad299b3021dfa9896.tar.gz
qemu-9b1268f55ceb0d9390a051cad299b3021dfa9896.tar.bz2
semihosting: Fix handling of buffer in TARGET_SYS_TMPNAM
The TARGET_SYS_TMPNAM implementation has two bugs spotted by Coverity: * confusion about whether 'len' has the length of the string including or excluding the terminating NUL means we lock_user() len bytes of memory but memcpy() len + 1 bytes * In the error-exit cases we forget to free() the buffer that asprintf() returned to us Resolves: Coverity CID 1490285, 1490289 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20220719121110.225657-5-peter.maydell@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20220725140520.515340-10-alex.bennee@linaro.org>
Diffstat (limited to 'semihosting')
-rw-r--r--semihosting/arm-compat-semi.c13
1 files changed, 11 insertions, 2 deletions
diff --git a/semihosting/arm-compat-semi.c b/semihosting/arm-compat-semi.c
index d12288f..e741674 100644
--- a/semihosting/arm-compat-semi.c
+++ b/semihosting/arm-compat-semi.c
@@ -504,16 +504,25 @@ void do_common_semihosting(CPUState *cs)
GET_ARG(1);
GET_ARG(2);
len = asprintf(&s, "/tmp/qemu-%x%02x", getpid(), (int)arg1 & 0xff);
+ if (len < 0) {
+ common_semi_set_ret(cs, -1);
+ break;
+ }
+
+ /* Allow for trailing NUL */
+ len++;
/* Make sure there's enough space in the buffer */
- if (len < 0 || len >= arg2) {
+ if (len > arg2) {
+ free(s);
common_semi_set_ret(cs, -1);
break;
}
p = lock_user(VERIFY_WRITE, arg0, len, 0);
if (!p) {
+ free(s);
goto do_fault;
}
- memcpy(p, s, len + 1);
+ memcpy(p, s, len);
unlock_user(p, arg0, len);
free(s);
common_semi_set_ret(cs, 0);