[Top][All Lists]
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH 1/2] hmp: expr_unary(): check for overflow in st
From: |
Luiz Capitulino |
Subject: |
Re: [Qemu-devel] [PATCH 1/2] hmp: expr_unary(): check for overflow in strtoul() |
Date: |
Thu, 26 Apr 2012 20:18:02 -0300 |
On Thu, 26 Apr 2012 15:34:50 -0600
Eric Blake <address@hidden> wrote:
> On 04/26/2012 03:10 PM, Luiz Capitulino wrote:
> > It's not checked currently, so something like:
> >
> > (qemu) balloon -100000000000001111114334234
> > (qemu)
> >
> > Will just "work" (in this case the balloon command will get a random
> > value).
> >
> > Fix it by checking if strtout() overflowed.
> >
> > Signed-off-by: Luiz Capitulino <address@hidden>
> > ---
> > monitor.c | 6 ++++++
> > 1 file changed, 6 insertions(+)
> >
> > diff --git a/monitor.c b/monitor.c
> > index 8946a10..6178f48 100644
> > --- a/monitor.c
> > +++ b/monitor.c
> > @@ -3122,8 +3122,14 @@ static int64_t expr_unary(Monitor *mon)
> > default:
> > #if TARGET_PHYS_ADDR_BITS > 32
> > n = strtoull(pch, &p, 0);
>
> strtoull and friends are evil. That's why libvirt has a rule that all
> string-to-integer conversion must go through a libvirt wrapper call, and
> _only_ the wrapper may use strtoull (since that one use has been audited
> for correctness).
We could add a wrapper too, but I'll only fix the bug for now.
>
> > + if (n == ULLONG_MAX && errno == ERANGE) {
>
> Not quite right. ULLONG_MAX is a valid return, but you did not prime
> errno, so if errno has junk ERANGE from some earlier point in the
> program, you will have a false negative. You are guaranteed that errno
> is unchanged on success, so prime things by setting errno to 0 before
> calling strtoull.
I thought about doing that but - hope that won't sound stupid - how can I
guarantee that ERANGE is not 0?
> > + expr_error(mon, "error: too long number");
>
> Grammar - this reads better as 'number too long'.
Yes, Peter suggested something similar. Will change that.
[Qemu-devel] [PATCH 2/2] hmp: fix bad value conversion for M type, Luiz Capitulino, 2012/04/26