[Top][All Lists]
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH 1/2] hmp: expr_unary(): check for overflow in st
From: |
Markus Armbruster |
Subject: |
Re: [Qemu-devel] [PATCH 1/2] hmp: expr_unary(): check for overflow in strtoul()/strtoull() |
Date: |
Fri, 27 Apr 2012 11:04:20 +0200 |
User-agent: |
Gnus/5.13 (Gnus v5.13) Emacs/23.3 (gnu/linux) |
Luiz Capitulino <address@hidden> writes:
> It's not checked currently, so something like:
>
> (qemu) balloon -100000000000001111114334234
> (qemu)
>
> Will just "work" (in this case the balloon command will get a random
> value).
>
> Fix it by checking if strtoul()/strtoull() overflowed.
>
> Signed-off-by: Luiz Capitulino <address@hidden>
> ---
> monitor.c | 7 +++++++
> 1 file changed, 7 insertions(+)
>
> diff --git a/monitor.c b/monitor.c
> index 8946a10..56ee971 100644
> --- a/monitor.c
> +++ b/monitor.c
> @@ -3120,10 +3120,17 @@ static int64_t expr_unary(Monitor *mon)
> n = 0;
> break;
> default:
> + errno = 0;
> #if TARGET_PHYS_ADDR_BITS > 32
> n = strtoull(pch, &p, 0);
> + if (n == ULLONG_MAX && errno == ERANGE) {
> + expr_error(mon, "number too large");
> + }
The test n == ULLONG_MAX is redundant.
You silently interpret a string that doesn't parse as zero.
Failure modes of strtol() & friends:
1. String is empty or doesn't have the expected form
Test: p == pch
2. String has the expected form, but number overflows result
Test: errno == ERANGE (need to errno = 0 before the call)
3. String has the expected form, but there's junk after the number
Test: p != pch && "*pch isn't in the follow set"
Many places in QEMU silently ignore trailing junk, so not checking
this could be excused.
> #else
> n = strtoul(pch, &p, 0);
> + if (n == ULONG_MAX && errno == ERANGE) {
> + expr_error(mon, "number too large");
> + }
> #endif
> if (pch == p) {
> expr_error(mon, "invalid char in expression");
- [Qemu-devel] [PATCH v2 0/2]: hmp: integer parsing fixes, Luiz Capitulino, 2012/04/26
- [Qemu-devel] [PATCH 1/2] hmp: expr_unary(): check for overflow in strtoul()/strtoull(), Luiz Capitulino, 2012/04/26
- Re: [Qemu-devel] [PATCH 1/2] hmp: expr_unary(): check for overflow in strtoul()/strtoull(),
Markus Armbruster <=
- Re: [Qemu-devel] [PATCH 1/2] hmp: expr_unary(): check for overflow in strtoul()/strtoull(), Eric Blake, 2012/04/27
- Re: [Qemu-devel] [PATCH 1/2] hmp: expr_unary(): check for overflow in strtoul()/strtoull(), Luiz Capitulino, 2012/04/27
- Re: [Qemu-devel] [PATCH 1/2] hmp: expr_unary(): check for overflow in strtoul()/strtoull(), Markus Armbruster, 2012/04/27
- Re: [Qemu-devel] [PATCH 1/2] hmp: expr_unary(): check for overflow in strtoul()/strtoull(), Luiz Capitulino, 2012/04/27
- Re: [Qemu-devel] [PATCH 1/2] hmp: expr_unary(): check for overflow in strtoul()/strtoull(), Eric Blake, 2012/04/27
- Re: [Qemu-devel] [PATCH 1/2] hmp: expr_unary(): check for overflow in strtoul()/strtoull(), Luiz Capitulino, 2012/04/27
- Re: [Qemu-devel] [PATCH 1/2] hmp: expr_unary(): check for overflow in strtoul()/strtoull(), Markus Armbruster, 2012/04/27
[Qemu-devel] [PATCH 2/2] hmp: fix bad value conversion for M type, Luiz Capitulino, 2012/04/26