git: 5ce0ab735526 - main - bhyve: fix integer overflow in qXfer packet parser

The branch main has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=5ce0ab7355264d38fcde4684f0a64347ec0f5234

commit 5ce0ab7355264d38fcde4684f0a64347ec0f5234
Author:     Osvaldo Janeri Filho <ojanerif@amd.com>
AuthorDate: 2026-10-19 18:53:05 +0000
Commit:     Mark Johnston <markj@FreeBSD.org>
CommitDate: 2026-10-19 18:53:53 +0000

    bhyve: fix integer overflow in qXfer packet parser
    
    doff + dlen overflows unsigned int when both values are close to UINT_MAX,
    causing the wrong branch to execute and passing an unbounded length to
    append_binary_data().  Rewrite the comparison to avoid the addition.
    
    Reviewed by:    markj
    Fixes:          f81cdf24ba54 ("bhyve: Add support for XML register definitions")
    MFC after:      1 week
    Differential Revision:  https://reviews.freebsd.org/D60847
---
 usr.sbin/bhyve/gdb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/usr.sbin/bhyve/gdb.c b/usr.sbin/bhyve/gdb.c
index c0e9a1547271..3f5c511b820f 100644
--- a/usr.sbin/bhyve/gdb.c
+++ b/usr.sbin/bhyve/gdb.c
@@ -1841,7 +1841,7 @@ gdb_query(const uint8_t *data, size_t len)
 		start_packet();
 		if (doff >= xmllen) {
 			append_char('l');
-		} else if (doff + dlen >= xmllen) {
+		} else if (dlen >= xmllen - doff) {
 			append_char('l');
 			append_binary_data(xml + doff, xmllen - doff);
 		} else {