diff options
| -rw-r--r-- | semihosting/syscalls.c | 16 |
1 files changed, 16 insertions, 0 deletions
diff --git a/semihosting/syscalls.c b/semihosting/syscalls.c index 5cb12d6adc..eefbae74f1 100644 --- a/semihosting/syscalls.c +++ b/semihosting/syscalls.c @@ -283,6 +283,14 @@ void semihost_sys_close(CPUState *cs, gdb_syscall_complete_cb complete, int fd) void semihost_sys_read_gf(CPUState *cs, gdb_syscall_complete_cb complete, GuestFD *gf, target_ulong buf, target_ulong len) { + /* + * Bound length for 64-bit guests on 32-bit hosts, not overlowing ssize_t. + * Note the Linux kernel does this with MAX_RW_COUNT, so it's not a bad + * idea to do this unconditionally. + */ + if (len > INT32_MAX) { + len = INT32_MAX; + } switch (gf->type) { case GuestFDGDB: gdb_read(cs, complete, gf, buf, len); @@ -313,6 +321,14 @@ void semihost_sys_read(CPUState *cs, gdb_syscall_complete_cb complete, void semihost_sys_write_gf(CPUState *cs, gdb_syscall_complete_cb complete, GuestFD *gf, target_ulong buf, target_ulong len) { + /* + * Bound length for 64-bit guests on 32-bit hosts, not overlowing ssize_t. + * Note the Linux kernel does this with MAX_RW_COUNT, so it's not a bad + * idea to do this unconditionally. + */ + if (len > INT32_MAX) { + len = INT32_MAX; + } switch (gf->type) { case GuestFDGDB: gdb_write(cs, complete, gf, buf, len); |