Merge remote-tracking branch 'remotes/mjt/tags/pull-trivial-patches-2015-11-06' into staging

trivial patches for 2015-11-06

# gpg: Signature made Fri 06 Nov 2015 12:42:43 GMT using RSA key ID A4C3D7DB
# gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>"
# gpg:                 aka "Michael Tokarev <mjt@corpit.ru>"
# gpg:                 aka "Michael Tokarev <mjt@debian.org>"

* remotes/mjt/tags/pull-trivial-patches-2015-11-06: (24 commits)
  tap-bsd: use user-specified tap device if it already exists
  qemu-sockets: do not test path with access() before unlinking
  taget-ppc: Fix read access to IBAT registers higher than IBAT3
  exec: avoid unnecessary cacheline bounce on ram_list.mru_block
  target-alpha: fix uninitialized variable
  ivshmem-server: fix possible OVERRUN
  pci-assign: do not test path with access() before opening
  qom/object: fix 2 comment typos
  configure: remove help string for 'vnc-tls' option
  usb: Use g_new() & friends where that makes obvious sense
  qxl: Use g_new() & friends where that makes obvious sense
  ui: Use g_new() & friends where that makes obvious sense
  bt: fix use of uninitialized variable seqlen
  hw/dma/pxa2xx: Remove superfluous memset
  linux-user/syscall: Replace g_malloc0 + memcpy with g_memdup
  tests/i44fx-test: No need for zeroing memory before memset
  hw/input/tsc210x: Remove superfluous memset
  xen: fix invalid assertion
  tests: ignore test-qga
  fix bad indentation in pcie_cap_slot_write_config()
  ...

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

1 files changed, 16 insertions, 2 deletions

diff --git a/gdbstub.c b/gdbstub.c
index d2c95b5d1e..9c29aa0e87 100644
--- a/gdbstub.c
+++ b/gdbstub.c
@@ -956,6 +956,13 @@ static int gdb_handle_packet(GDBState *s, const char *line_buf)
         if (*p == ',')
             p++;
         len = strtoull(p, NULL, 16);
+
+        /* memtohex() doubles the required space */
+        if (len > MAX_PACKET_LENGTH / 2) {
+            put_packet (s, "E22");
+            break;
+        }
+
         if (target_memory_rw_debug(s->g_cpu, addr, mem_buf, len, false) != 0) {
             put_packet (s, "E14");
         } else {
@@ -970,6 +977,12 @@ static int gdb_handle_packet(GDBState *s, const char *line_buf)
         len = strtoull(p, (char **)&p, 16);
         if (*p == ':')
             p++;
+
+        /* hextomem() reads 2*len bytes */
+        if (len > strlen(p) / 2) {
+            put_packet (s, "E22");
+            break;
+        }
         hextomem(mem_buf, p, len);
         if (target_memory_rw_debug(s->g_cpu, addr, mem_buf, len,
                                    true) != 0) {
@@ -1107,7 +1120,8 @@ static int gdb_handle_packet(GDBState *s, const char *line_buf)
             cpu = find_cpu(thread);
             if (cpu != NULL) {
                 cpu_synchronize_state(cpu);
-                len = snprintf((char *)mem_buf, sizeof(mem_buf),
+                /* memtohex() doubles the required space */
+                len = snprintf((char *)mem_buf, sizeof(buf) / 2,
                                "CPU#%d [%s]", cpu->cpu_index,
                                cpu->halted ? "halted " : "running");
                 memtohex(buf, mem_buf, len);
@@ -1136,8 +1150,8 @@ static int gdb_handle_packet(GDBState *s, const char *line_buf)
                 put_packet(s, "E01");
                 break;
             }
-            hextomem(mem_buf, p + 5, len);
             len = len / 2;
+            hextomem(mem_buf, p + 5, len);
             mem_buf[len++] = 0;
             qemu_chr_be_write(s->mon_chr, mem_buf, len);
             put_packet(s, "OK");