[Top][All Lists]
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH] Fix subtle integer overflow bug in memory API
From: |
David Gibson |
Subject: |
[Qemu-devel] [PATCH] Fix subtle integer overflow bug in memory API |
Date: |
Wed, 14 Sep 2011 17:02:49 +1000 |
It is quite common to have a MemoryRegion with size of INT64_MAX.
When processing alias regions in render_memory_region() it's quite
easy to find a case where it will construct a temporary AddrRange with
a non-zero start, and size still of INT64_MAX. When means attempting
to compute the end of such a range as start + size will result in
signed integer overflow.
This integer overflow means that addrrange_intersects() can
incorrectly report regions as not intersecting when they do. For
example consider the case of address ranges {0x10000000000,
0x7fffffffffffffff} and {0x10010000000, 0x10000000} where the second
is in fact included completely in the first.
This patch rearranges addrrange_intersects() to avoid the integer
overflow, correcting this behaviour.
Signed-off-by: David Gibson <address@hidden>
---
memory.c | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/memory.c b/memory.c
index 57f0fa4..101b67c 100644
--- a/memory.c
+++ b/memory.c
@@ -55,8 +55,8 @@ static AddrRange addrrange_shift(AddrRange range, int64_t
delta)
static bool addrrange_intersects(AddrRange r1, AddrRange r2)
{
- return (r1.start >= r2.start && r1.start < r2.start + r2.size)
- || (r2.start >= r1.start && r2.start < r1.start + r1.size);
+ return (r1.start >= r2.start && (r1.start - r2.start) < r2.size)
+ || (r2.start >= r1.start && (r2.start - r1.start) < r1.size);
}
static AddrRange addrrange_intersection(AddrRange r1, AddrRange r2)
--
1.7.5.4
- [Qemu-devel] [PATCH] Fix subtle integer overflow bug in memory API,
David Gibson <=