REDHAT-BUG-2565679: Buffer Overflow

Heap buffer overflow in cmdqtdpsrc (gdbserver/tracepoint.cc). The function allocates xmalloc(slen+1) sized by the packet's declared slen field, but calls hex2bin(packet, src, strlen(packet)/2) using the actual hex data length independently. When actual data exceeds declared slen, hex2bin overflows the heap buffer by the difference with attacker-controlled content. Demonstrated exploitation: overflow corrupts processinfoprivate::threaddb, replacing the tdtamaplwp2thrp function pointer with an attacker-chosen address. A subsequent qGetTLSAddr packet causes gdbserver to call through the forged pointer, achieving RIP control and native code execution.