From patchwork Wed Sep 14 07:02:49 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: David Gibson X-Patchwork-Id: 114582 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [140.186.70.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (Client did not present a certificate) by ozlabs.org (Postfix) with ESMTPS id 946A1B71C7 for ; Wed, 14 Sep 2011 17:03:14 +1000 (EST) Received: from localhost ([::1]:47840 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1R3jUz-00040q-D9 for incoming@patchwork.ozlabs.org; Wed, 14 Sep 2011 03:03:09 -0400 Received: from eggs.gnu.org ([140.186.70.92]:39396) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1R3jUr-0003zI-Jg for qemu-devel@nongnu.org; Wed, 14 Sep 2011 03:03:02 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1R3jUq-00035h-7I for qemu-devel@nongnu.org; Wed, 14 Sep 2011 03:03:01 -0400 Received: from ozlabs.org ([203.10.76.45]:43714) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1R3jUp-0002zh-Jl for qemu-devel@nongnu.org; Wed, 14 Sep 2011 03:03:00 -0400 Received: by ozlabs.org (Postfix, from userid 1007) id BBA9CB71D4; Wed, 14 Sep 2011 17:02:52 +1000 (EST) From: David Gibson To: avi@redhat.com Date: Wed, 14 Sep 2011 17:02:49 +1000 Message-Id: <1315983769-8287-1-git-send-email-david@gibson.dropbear.id.au> X-Mailer: git-send-email 1.7.5.4 X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 203.10.76.45 Cc: agraf@suse.de, qemu-devel@nongnu.org Subject: [Qemu-devel] [PATCH] Fix subtle integer overflow bug in memory API X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org It is quite common to have a MemoryRegion with size of INT64_MAX. When processing alias regions in render_memory_region() it's quite easy to find a case where it will construct a temporary AddrRange with a non-zero start, and size still of INT64_MAX. When means attempting to compute the end of such a range as start + size will result in signed integer overflow. This integer overflow means that addrrange_intersects() can incorrectly report regions as not intersecting when they do. For example consider the case of address ranges {0x10000000000, 0x7fffffffffffffff} and {0x10010000000, 0x10000000} where the second is in fact included completely in the first. This patch rearranges addrrange_intersects() to avoid the integer overflow, correcting this behaviour. Signed-off-by: David Gibson --- memory.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/memory.c b/memory.c index 57f0fa4..101b67c 100644 --- a/memory.c +++ b/memory.c @@ -55,8 +55,8 @@ static AddrRange addrrange_shift(AddrRange range, int64_t delta) static bool addrrange_intersects(AddrRange r1, AddrRange r2) { - return (r1.start >= r2.start && r1.start < r2.start + r2.size) - || (r2.start >= r1.start && r2.start < r1.start + r1.size); + return (r1.start >= r2.start && (r1.start - r2.start) < r2.size) + || (r2.start >= r1.start && (r2.start - r1.start) < r1.size); } static AddrRange addrrange_intersection(AddrRange r1, AddrRange r2)