Re: [Qemu-devel] [PATCH 1/2] hmp: expr_unary(): check for overflow in strtoul()

[Peter Maydell]

On 26 April 2012 22:10, Luiz Capitulino <address@hidden> wrote:
> It's not checked currently, so something like:
>
>  (qemu) balloon -100000000000001111114334234
>  (qemu)
>
> Will just "work" (in this case the balloon command will get a random
> value).
>
> Fix it by checking if strtout() overflowed.

"strtoul()/strtoull()".

> Signed-off-by: Luiz Capitulino <address@hidden>
> ---
>  monitor.c |    6 ++++++
>  1 file changed, 6 insertions(+)
>
> diff --git a/monitor.c b/monitor.c
> index 8946a10..6178f48 100644
> --- a/monitor.c
> +++ b/monitor.c
> @@ -3122,8 +3122,14 @@ static int64_t expr_unary(Monitor *mon)
>     default:
>  #if TARGET_PHYS_ADDR_BITS > 32
>         n = strtoull(pch, &p, 0);
> +        if (n == ULLONG_MAX && errno == ERANGE) {
> +            expr_error(mon, "error: too long number");
> +        }
>  #else
>         n = strtoul(pch, &p, 0);
> +        if (n == ULONG_MAX && errno == ERANGE) {
> +            expr_error(mon, "error: too long number");
> +        }
>  #endif
>         if (pch == p) {
>             expr_error(mon, "invalid char in expression");

None of the other expr_error()s here say "error: ", so
for consistency this one shouldn't either.
Also, perhaps "number out of range" or "number too large"
would sound better?

(Incidentally I was surprised that this code cared about
TARGET_PHYS_ADDR_BITS...)

-- PMM