Re: [Qemu-devel] [PATCH 1/2] hmp: expr_unary(): check for overflow in strtoul()/strtoull()

[Eric Blake]

On 04/27/2012 03:04 AM, Markus Armbruster wrote:
> Luiz Capitulino <address@hidden> writes:
> 
>> It's not checked currently, so something like:
>>

>> +++ b/monitor.c
>> @@ -3120,10 +3120,17 @@ static int64_t expr_unary(Monitor *mon)
>>          n = 0;
>>          break;
>>      default:
>> +        errno = 0;
>>  #if TARGET_PHYS_ADDR_BITS > 32
>>          n = strtoull(pch, &p, 0);
>> +        if (n == ULLONG_MAX && errno == ERANGE) {
>> +            expr_error(mon, "number too large");
>> +        }
> 
> The test n == ULLONG_MAX is redundant.

But harmless.

> 
> You silently interpret a string that doesn't parse as zero.

No...

>> +        if (n == ULONG_MAX && errno == ERANGE) {
>> +            expr_error(mon, "number too large");
>> +        }
>>  #endif
>>          if (pch == p) {
>>              expr_error(mon, "invalid char in expression");

that check was already present.

-- 
Eric Blake   address@hidden    +1-919-301-3266
Libvirt virtualization library http://libvirt.org

signature.asc
Description: OpenPGP digital signature