fridtjof/qemu-cr16
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

replay: Improve assert in replay_char_read_all_load()

Browse source 
In replay_char_read_all_load() we get a buffer and size from the
replay log.  We know the size has to fit an int because of how we
write the log.  However the way we assert this is wrong: we cast the
size_t from replay_get_array() to an int and then check that it is
non-negative.  This misses cases where an over-large size is
truncated into a positive value by the cast.

Replace the assertion with checking that the size is in-range
before doing the cast.

Coverity complained about the possible overflow: CID 1643440.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251124173407.50124-1-peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
This commit is contained in:
Peter Maydell 2025-11-24 17:34:07 +00:00 • committed by Philippe Mathieu-Daudé
parent 77f4f14e08
commit 78d66a25c5
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
replay/replay-char.c
View file

@ -126,8 +126,8 @@ int replay_char_read_all_load(uint8_t *buf)
int res; int res;
replay_get_array(buf, &size); replay_get_array(buf, &size);
replay_finish_event(); replay_finish_event();
assert(size <= INT_MAX);
res = (int)size; res = (int)size;
assert(res >= 0);
return res; return res;
} else if (replay_next_event_is(EVENT_CHAR_READ_ALL_ERROR)) { } else if (replay_next_event_is(EVENT_CHAR_READ_ALL_ERROR)) {
int res = replay_get_dword(); int res = replay_get_dword();