diff mbox

[PULL] Memory core integer overflow fix

Message ID 4E70A29F.1010105@redhat.com
State New
Headers show

Commit Message

Avi Kivity Sept. 14, 2011, 12:48 p.m. UTC
Please pull from

   git://github.com/avikivity/qemu.git memory/core

to receive a core fix for an integer overflow problem hitting ppc:

David Gibson (1):
       Fix subtle integer overflow bug in memory API

  memory.c |    4 ++--
  1 files changed, 2 insertions(+), 2 deletions(-)

  static AddrRange addrrange_intersection(AddrRange r1, AddrRange r2)

Comments

Anthony Liguori Sept. 15, 2011, 7:10 p.m. UTC | #1
On 09/14/2011 07:48 AM, Avi Kivity wrote:
> Please pull from
>
> git://github.com/avikivity/qemu.git memory/core
>
> to receive a core fix for an integer overflow problem hitting ppc:
>
> David Gibson (1):
> Fix subtle integer overflow bug in memory API

Pulled.  Thanks.

Regards,

Anthony Liguori


>
> memory.c | 4 ++--
> 1 files changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/memory.c b/memory.c
> index 57f0fa4..101b67c 100644
> --- a/memory.c
> +++ b/memory.c
> @@ -55,8 +55,8 @@ static AddrRange addrrange_shift(AddrRange range, int64_t delta)
>
> static bool addrrange_intersects(AddrRange r1, AddrRange r2)
> {
> - return (r1.start >= r2.start && r1.start < r2.start + r2.size)
> - || (r2.start >= r1.start && r2.start < r1.start + r1.size);
> + return (r1.start >= r2.start && (r1.start - r2.start) < r2.size)
> + || (r2.start >= r1.start && (r2.start - r1.start) < r1.size);
> }
>
> static AddrRange addrrange_intersection(AddrRange r1, AddrRange r2)
>
diff mbox

Patch

diff --git a/memory.c b/memory.c
index 57f0fa4..101b67c 100644
--- a/memory.c
+++ b/memory.c
@@ -55,8 +55,8 @@  static AddrRange addrrange_shift(AddrRange range, 
int64_t delta)

  static bool addrrange_intersects(AddrRange r1, AddrRange r2)
  {
-    return (r1.start >= r2.start && r1.start < r2.start + r2.size)
-        || (r2.start >= r1.start && r2.start < r1.start + r1.size);
+    return (r1.start >= r2.start && (r1.start - r2.start) < r2.size)
+        || (r2.start >= r1.start && (r2.start - r1.start) < r1.size);
  }