git: 91ebe67e90d5 - stable/14 - bhyve: Avoid underflows when handling remote commands

The branch stable/14 has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=91ebe67e90d5859df282aac9c978e54789217b12

commit 91ebe67e90d5859df282aac9c978e54789217b12
Author:     Mark Johnston <markj@FreeBSD.org>
AuthorDate: 2024-01-23 16:40:40 +0000
Commit:     Mark Johnston <markj@FreeBSD.org>
CommitDate: 2024-01-30 14:18:53 +0000

    bhyve: Avoid underflows when handling remote commands
    
    Reviewed by:    corvink, jhb
    MFC after:      1 week
    Sponsored by:   Innovate UK
    Differential Revision:  https://reviews.freebsd.org/D43480
    
    (cherry picked from commit cfa2c78aee859bfc6549951bb6a36085fdd374e8)
---
 usr.sbin/bhyve/gdb.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/usr.sbin/bhyve/gdb.c b/usr.sbin/bhyve/gdb.c
index 9748f7d82b44..cc05a32a5c56 100644
--- a/usr.sbin/bhyve/gdb.c
+++ b/usr.sbin/bhyve/gdb.c
@@ -1053,6 +1053,8 @@ gdb_read_mem(const uint8_t *data, size_t len)
 	bool started;
 	int error;
 
+	assert(len >= 1);
+
 	/* Skip 'm' */
 	data += 1;
 	len -= 1;
@@ -1164,6 +1166,8 @@ gdb_write_mem(const uint8_t *data, size_t len)
 	size_t resid, todo, bytes;
 	int error;
 
+	assert(len >= 1);
+
 	/* Skip 'M' */
 	data += 1;
 	len -= 1;
@@ -1558,7 +1562,7 @@ gdb_query(const uint8_t *data, size_t len)
 
 		data += strlen("qThreadExtraInfo");
 		len -= strlen("qThreadExtraInfo");
-		if (*data != ',') {
+		if (len == 0 || *data != ',') {
 			send_error(EINVAL);
 			return;
 		}
@@ -1609,7 +1613,7 @@ handle_command(const uint8_t *data, size_t len)
 	case 'H': {
 		int tid;
 
-		if (data[1] != 'g' && data[1] != 'c') {
+		if (len < 2 || (data[1] != 'g' && data[1] != 'c')) {
 			send_error(EINVAL);
 			break;
 		}