* [Qemu-devel] coverity detected issue in contrib/elf2dmp/main.c
@ 2019-02-14 18:58 Peter Maydell
2019-02-16 7:42 ` Viktor Prutyanov
0 siblings, 1 reply; 2+ messages in thread
From: Peter Maydell @ 2019-02-14 18:58 UTC (permalink / raw)
To: QEMU Developers; +Cc: Viktor Prutyanov
Hi; Coverity detected an issue in contrib/elf2dmp/main.c (CID 1398641).
In this loop:
for (; KernBase >= 0xfffff78000000000; KernBase -= PAGE_SIZE) {
nt_start_addr = va_space_resolve(&vs, KernBase);
if (!nt_start_addr) {
continue;
}
if (*(uint16_t *)nt_start_addr == 0x5a4d) { /* MZ */
break;
}
}
we might end exiting with nt_start_addr == NULL, if we go all
the way through the address range without finding anything
and the loop terminates via the "KernBase >= 0xfffff78000000000"
condition.
However, we don't check for this, so we will then segfault
in pe_get_pdb_symstore_hash(), which assumes it's passed a non-NULL
address.
I guess we should be checking for nt_start_addr == NULL at the
end of the loop and treating it as a fatal error?
thanks
-- PMM
^ permalink raw reply [flat|nested] 2+ messages in thread* Re: [Qemu-devel] coverity detected issue in contrib/elf2dmp/main.c
2019-02-14 18:58 [Qemu-devel] coverity detected issue in contrib/elf2dmp/main.c Peter Maydell
@ 2019-02-16 7:42 ` Viktor Prutyanov
0 siblings, 0 replies; 2+ messages in thread
From: Viktor Prutyanov @ 2019-02-16 7:42 UTC (permalink / raw)
To: Peter Maydell; +Cc: QEMU Developers
On Thu, 14 Feb 2019 18:58:46 +0000
Peter Maydell <peter.maydell@linaro.org> wrote:
Hi
> Hi; Coverity detected an issue in contrib/elf2dmp/main.c (CID
> 1398641). In this loop:
>
> for (; KernBase >= 0xfffff78000000000; KernBase -= PAGE_SIZE) {
> nt_start_addr = va_space_resolve(&vs, KernBase);
> if (!nt_start_addr) {
> continue;
> }
>
> if (*(uint16_t *)nt_start_addr == 0x5a4d) { /* MZ */
> break;
> }
> }
>
> we might end exiting with nt_start_addr == NULL, if we go all
> the way through the address range without finding anything
> and the loop terminates via the "KernBase >= 0xfffff78000000000"
> condition.
>
> However, we don't check for this, so we will then segfault
> in pe_get_pdb_symstore_hash(), which assumes it's passed a non-NULL
> address.
>
> I guess we should be checking for nt_start_addr == NULL at the
> end of the loop and treating it as a fatal error?
You're right. I will make a fix.
>
> thanks
> -- PMM
--
Viktor Prutyanov
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2019-02-16 7:42 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2019-02-14 18:58 [Qemu-devel] coverity detected issue in contrib/elf2dmp/main.c Peter Maydell
2019-02-16 7:42 ` Viktor Prutyanov
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).