| Message ID | 150642400352.3900.13935192906711901682.stgit@Misha-PC.lan02.inno |
|---|---|
| State | New |
| Headers | show |
| Series | Windbg supporting | expand |
On Tue, Sep 26, 2017 at 1:06 PM, Mihail Abakumov <mikhail.abakumov@ispras.ru> wrote: > Signed-off-by: Mihail Abakumov <mikhail.abakumov@ispras.ru> > Signed-off-by: Pavel Dovgalyuk <dovgaluk@ispras.ru> > Signed-off-by: Dmitriy Koltunov <koltunov@ispras.ru> > --- > windbgstub-utils.c | 38 ++++++++++++++++++++++++++++++++++++++ > 1 file changed, 38 insertions(+) > > diff --git a/windbgstub-utils.c b/windbgstub-utils.c > index 73ff98dfbc..537ba9e2aa 100755 > --- a/windbgstub-utils.c > +++ b/windbgstub-utils.c > @@ -587,6 +587,44 @@ static int windbg_write_context(CPUState *cpu, uint8_t *buf, int len, > static int windbg_read_ks_regs(CPUState *cpu, uint8_t *buf, int len, > int offset) > { > + CPUArchState *env = cpu->env_ptr; > + const bool new_mem = (len != sizeof(CPU_KSPECIAL_REGISTERS) > + || offset != 0); > + CPU_KSPECIAL_REGISTERS *ckr; > + if (new_mem) { > + ckr = g_new(CPU_KSPECIAL_REGISTERS, 1); > + } else { > + ckr = (CPU_KSPECIAL_REGISTERS *) buf; > + } > + > + memset(ckr, 0, len); Buffer overrun on len > sizeof(CPU_KSPECIAL_REGISTERS). > + ckr->Cr0 = ldl_p(&env->cr[0]); > + ckr->Cr2 = ldl_p(&env->cr[2]); > + ckr->Cr3 = ldl_p(&env->cr[3]); > + ckr->Cr4 = ldl_p(&env->cr[4]); > + > + ckr->KernelDr0 = ldtul_p(&env->dr[0]); > + ckr->KernelDr1 = ldtul_p(&env->dr[1]); > + ckr->KernelDr2 = ldtul_p(&env->dr[2]); > + ckr->KernelDr3 = ldtul_p(&env->dr[3]); > + ckr->KernelDr6 = ldtul_p(&env->dr[6]); > + ckr->KernelDr7 = ldtul_p(&env->dr[7]); > + > + ckr->Gdtr.Pad = lduw_p(&env->gdt.selector); > + ckr->Idtr.Pad = lduw_p(&env->idt.selector); > + > + ckr->Gdtr.Limit = lduw_p(&env->gdt.limit); > + ckr->Gdtr.Base = ldtul_p(&env->gdt.base); > + ckr->Idtr.Limit = lduw_p(&env->idt.limit); > + ckr->Idtr.Base = ldtul_p(&env->idt.base); > + ckr->Tr = lduw_p(&env->tr.selector); > + ckr->Ldtr = lduw_p(&env->ldt.selector); > + > + if (new_mem) { > + memcpy(buf, (uint8_t *) ckr + offset, len); > + g_free(ckr); > + } > return 0; > } > >
diff --git a/windbgstub-utils.c b/windbgstub-utils.c index 73ff98dfbc..537ba9e2aa 100755 --- a/windbgstub-utils.c +++ b/windbgstub-utils.c @@ -587,6 +587,44 @@ static int windbg_write_context(CPUState *cpu, uint8_t *buf, int len, static int windbg_read_ks_regs(CPUState *cpu, uint8_t *buf, int len, int offset) { + CPUArchState *env = cpu->env_ptr; + const bool new_mem = (len != sizeof(CPU_KSPECIAL_REGISTERS) + || offset != 0); + CPU_KSPECIAL_REGISTERS *ckr; + if (new_mem) { + ckr = g_new(CPU_KSPECIAL_REGISTERS, 1); + } else { + ckr = (CPU_KSPECIAL_REGISTERS *) buf; + } + + memset(ckr, 0, len); + + ckr->Cr0 = ldl_p(&env->cr[0]); + ckr->Cr2 = ldl_p(&env->cr[2]); + ckr->Cr3 = ldl_p(&env->cr[3]); + ckr->Cr4 = ldl_p(&env->cr[4]); + + ckr->KernelDr0 = ldtul_p(&env->dr[0]); + ckr->KernelDr1 = ldtul_p(&env->dr[1]); + ckr->KernelDr2 = ldtul_p(&env->dr[2]); + ckr->KernelDr3 = ldtul_p(&env->dr[3]); + ckr->KernelDr6 = ldtul_p(&env->dr[6]); + ckr->KernelDr7 = ldtul_p(&env->dr[7]); + + ckr->Gdtr.Pad = lduw_p(&env->gdt.selector); + ckr->Idtr.Pad = lduw_p(&env->idt.selector); + + ckr->Gdtr.Limit = lduw_p(&env->gdt.limit); + ckr->Gdtr.Base = ldtul_p(&env->gdt.base); + ckr->Idtr.Limit = lduw_p(&env->idt.limit); + ckr->Idtr.Base = ldtul_p(&env->idt.base); + ckr->Tr = lduw_p(&env->tr.selector); + ckr->Ldtr = lduw_p(&env->ldt.selector); + + if (new_mem) { + memcpy(buf, (uint8_t *) ckr + offset, len); + g_free(ckr); + } return 0; }