Skip to content

Commit

Permalink
gdbstub: Correct misparsing of vCont C/S requests
Browse files Browse the repository at this point in the history
In the vCont packet, two of the command actions (C and S) take an
argument specifying the signal to be sent to the process/thread, which is
sent as an ASCII string of two hex digits which immediately follow the
'C' or 'S' character.

Our code for parsing this packet accidentally skipped the first of the
two bytes of the signal value, because it started parsing the hex string
at 'p + 1' when the preceding code had already moved past the 'C' or
'S' with "cur_action = *p++".

This meant that we would only do the right thing for signals below
10, and would misinterpret the rest.  For instance, when the debugger
wants to send the process a SIGPROF (27 on x86-64) we mangle this into
a SIGSEGV (11).

Remove the accidental double increment.

Fixes: https://bugs.launchpad.net/qemu/+bug/1773743
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20201121210342.10089-1-peter.maydell@linaro.org
  • Loading branch information
pm215 committed Dec 15, 2020
1 parent 5bfbd81 commit 3ddd903
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion gdbstub.c
Expand Up @@ -1243,7 +1243,7 @@ static int gdb_handle_vcont(const char *p)
cur_action = *p++;
if (cur_action == 'C' || cur_action == 'S') {
cur_action = qemu_tolower(cur_action);
res = qemu_strtoul(p + 1, &p, 16, &tmp);
res = qemu_strtoul(p, &p, 16, &tmp);
if (res) {
goto out;
}
Expand Down

0 comments on commit 3ddd903

Please sign in to comment.