mirror of https://gitlab.com/qemu-project/qemu
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
78d66a25c5
In replay_char_read_all_load() we get a buffer and size from the replay log. We know the size has to fit an int because of how we write the log. However the way we assert this is wrong: we cast the size_t from replay_get_array() to an int and then check that it is non-negative. This misses cases where an over-large size is truncated into a positive value by the cast. Replace the assertion with checking that the size is in-range before doing the cast. Coverity complained about the possible overflow: CID 1643440. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20251124173407.50124-1-peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> |
1 week ago | |
|---|---|---|
| .. | ||
| meson.build | 2 years ago | |
| replay-audio.c | 1 month ago | |
| replay-char.c | 1 week ago | |
| replay-debugging.c | 10 months ago | |
| replay-events.c | 3 months ago | |
| replay-input.c | 12 months ago | |
| replay-internal.c | 2 weeks ago | |
| replay-internal.h | 2 years ago | |
| replay-net.c | 12 months ago | |
| replay-random.c | 12 months ago | |
| replay-snapshot.c | 10 months ago | |
| replay-time.c | 12 months ago | |
| replay.c | 2 months ago | |
| stubs-system.c | 1 month ago | |
| trace-events | 2 weeks ago | |
| trace.h | 2 weeks ago | |