Skip to content

Commit

Permalink
Fix stack overflow in remoteMemoryRead
Browse files Browse the repository at this point in the history
When doing a remote memory read the debugger can ask for any size.
The buffer being allocated however was only 1024 bytes long and the
code in remoteMemoryRead also attempts to write a zero byte at the
end of the array. This code will now take the count of bytes the debugger
is trying to read and allocates a buffer that is count * 2 + 1 large. This is large
enough to hold the $02x formatted hex byte for each byte as well as the zero
byte written at the end.
  • Loading branch information
knightsc committed Nov 28, 2018
1 parent 4f28e84 commit dd2a1d9
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion src/gba/remote.cpp
Expand Up @@ -3684,7 +3684,7 @@ void remoteMemoryRead(char* p)
sscanf(p, "%x,%x:", &address, &count);
// monprintf("Memory read for %08x %d\n", address, count);

char buffer[1024];
char buffer[(count*2)+1];

char* s = buffer;
for (int i = 0; i < count; i++) {
Expand Down

0 comments on commit dd2a1d9

Please sign in to comment.