)]}'
{
  "commit": "4e4832dd72db59cf9348a5cb787fe65b738d7601",
  "tree": "633b77c930a94452c196b35e8d9cb597c35b6029",
  "parents": [
    "e29302cbe6ada855bb7f18854ad215533e15b2e9"
  ],
  "author": {
    "name": "Nguyen Dinh Phi",
    "email": "phind.uet@gmail.com",
    "time": "Mon Apr 06 13:04:54 2026 +0800"
  },
  "committer": {
    "name": "Peter Maydell",
    "email": "peter.maydell@linaro.org",
    "time": "Wed Apr 08 13:33:25 2026 +0100"
  },
  "message": "util/readline: Fix out-of-bounds access in readline_insert_char().\n\nCurrently, the readline_insert_char() function is guarded by the cursor\nposition (cmd_buf_index) rather than the actual buffer fill level(cmd_buf_size).\nThe current check is:\n\tif (rs-\u003ecmd_buf_index \u003c READLINE_CMD_BUF_SIZE)\n\nThis logic is flawed because if the command buffer is full and a user moves the\ncursor backward (e.g. by sending left arrow key), cmd_buf_index can be\ndecreased without descreasing of buffer size.\nThis allow subsequent insertions to increase cmd_buf_size past its maximum\nlimit of rs-\u003ecmd_buf.\n\nBecause in the ReadLineState struct, cmd_buf[READLINE_CMD_BUF_SIZE + 1] is\nimmediately followed by the cmd_buf_index integer, once the buffer size is\nsufficiently inflated, the memmove() operation inside readline_insert_char()\ncan write past the end of cmd_buf[] and overwrites cmd_buf_index itself.\n\nThe subsequent line:\n\trs-\u003ecmd_buf[rs-\u003ecmd_buf_index] \u003d ch;\n\nthen writes the input character to an address determined by the now-corrupted\nindex.\n\nBy providing a specifically crafted input sequence via HMP, this flaw can be\nused to redirect the write operation to overwrite any field within the\nReadLineState structure, which can lead to unpredictable behavior or\napplication crashes.\n\nFix this by adding the guard to check for buffer fullness.\n\nCc: qemu-stable@nongnu.org\nSigned-off-by: Nguyen Dinh Phi \u003cphind.uet@gmail.com\u003e\nMessage-id: 20260406050454.284873-2-phind.uet@gmail.com\nReviewed-by: Marc-André Lureau \u003cmarcandre.lureau@redhat.com\u003e\nSigned-off-by: Peter Maydell \u003cpeter.maydell@linaro.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "0f19674f52631e49f2c2adde38cd5bdaab09eb5d",
      "old_mode": 33188,
      "old_path": "util/readline.c",
      "new_id": "e2664e48ca1033e6e2692832a95c4e436ac7b039",
      "new_mode": 33188,
      "new_path": "util/readline.c"
    }
  ]
}