rizinorg/rizin
1
0
Fork 0
mirror of https://github.com/rizinorg/rizin.git synced 2026-10-11 22:19:51 +00:00
Code Issues Packages Projects Releases Wiki Activity

rzgdb: Fix oob write in handle_vFile_pread

Browse Source
This commit is contained in:
wargio
2026-09-13 15:31:53 +01:00
committed by Giovanni
parent 650b3016fc
commit aecbbc4975
3 changed files with 5 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
subprojects/rzgdb/include/gdbclient/responses.h
+1 -1
View File
@@ -30,7 +30,7 @@ int handle_setbp(libgdbr_t *g);
int handle_removebp(libgdbr_t *g);
int handle_attach(libgdbr_t *g);
int handle_vFile_open(libgdbr_t *g);
int handle_vFile_pread(libgdbr_t *g, ut8 *buf);
int handle_vFile_pread(libgdbr_t *g, ut8 *buf, size_t buf_len);
int handle_vFile_close(libgdbr_t *g);
int handle_stop_reason(libgdbr_t *g);
subprojects/rzgdb/src/gdbclient/core.c
+1 -1
View File
@@ -1546,7 +1546,7 @@ int gdbr_pread_file(libgdbr_t *g, ut8 *buf, ut64 max_len, uint32_t start_offset)
ret = -1;
goto end;
}
if ((ret1 = handle_vFile_pread(g, buf + ret)) < 0) {
if ((ret1 = handle_vFile_pread(g, buf + ret, max_len - ret)) < 0) {
ret = ret1;
goto end;
}
subprojects/rzgdb/src/gdbclient/responses.c
+3 -1
View File
@@ -142,7 +142,7 @@ int handle_vFile_open(libgdbr_t *g) {
return send_ack(g);
}
int handle_vFile_pread(libgdbr_t *g, ut8 *buf) {
int handle_vFile_pread(libgdbr_t *g, ut8 *buf, size_t buf_len) {
send_ack(g);
char *ptr;
int len;
@@ -163,6 +163,8 @@ int handle_vFile_pread(libgdbr_t *g, ut8 *buf) {
// Again, this is probably the end of file
if (len == 0) {
return 0;
} else if (len > buf_len) {
len = buf_len;
}
if (!(ptr = strchr(g->data, ';')) || ptr >= g->data + g->data_len) {
return -1;