qemu-devel
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Qemu-devel] [PATCH] memory: use signed arithmetic


From: Avi Kivity
Subject: Re: [Qemu-devel] [PATCH] memory: use signed arithmetic
Date: Wed, 03 Aug 2011 00:21:00 +0300
User-agent: Mozilla/5.0 (X11; Linux x86_64; rv:5.0) Gecko/20110707 Thunderbird/5.0

On 08/03/2011 12:15 AM, malc wrote:
On Tue, 2 Aug 2011, Avi Kivity wrote:

>  When trying to map an alias of a ram region, where the alias starts at
>  address A and we map it into address B, and A>  B, we had an arithmetic
>  underflow.  Because we use unsigned arithmetic, the underflow converted
>  into a large number which failed addrrange_intersects() tests.
>
>  The concrete example which triggered this was cirrus vga mapping
>  the framebuffer at offsets 0xc0000-0xc7fff (relative to the start of
>  the framebuffer) into offsets 0xa0000 (relative to system addres space
>  start).
>
>  With our favorite analogy of a windowing system, this is equivalent to
>  dragging a subwindow off the left edge of the screen, and failing to clip
>  it into its parent window which is on screen.
>
>  Fix by switching to signed arithmetic.

http://stackoverflow.com/questions/3679047/integer-overflow-in-c-standards-and-compilers

In other words UB land


No UB land.

Previously, we did something like 0x1000U - 0x2000U = 0xFFFF0000U, later checking that 0xFFFF0000U < 0U and failing.

Now, we do something like 0x1000 - 0x2000 = -0x1000, later checking that -0x1000 < 0, and suceeding.

In no case was there undefined behaviour involved. Unsigned underflow is defined (and produced bad results for this case), Signed underflow isn't defined (but doesn't occur in this case).

--
I have a truly marvellous patch that fixes the bug which this
signature is too narrow to contain.




reply via email to

[Prev in Thread] Current Thread [Next in Thread]