diff mbox

[2/2] hmp: fix bad value conversion for M type

Message ID 1335532712-11899-3-git-send-email-lcapitulino@redhat.com
State New
Headers show

Commit Message

Luiz Capitulino April 27, 2012, 1:18 p.m. UTC
The M type converts from megabytes to bytes. However, the value can be
negative before the conversion, which will lead to a flawed conversion.

For example, this:

 (qemu) balloon -1000000000000011
 (qemu)

Just "works", but the value passed by the balloon command will be
something else.

This patch fixes this problem by requering a positive value before
converting. There's really no reason to accept a negative value for
the M type.

Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
---
 monitor.c |    8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

Comments

Markus Armbruster April 27, 2012, 1:26 p.m. UTC | #1
Luiz Capitulino <lcapitulino@redhat.com> writes:

> The M type converts from megabytes to bytes. However, the value can be
> negative before the conversion, which will lead to a flawed conversion.
>
> For example, this:
>
>  (qemu) balloon -1000000000000011
>  (qemu)
>
> Just "works", but the value passed by the balloon command will be
> something else.
>
> This patch fixes this problem by requering a positive value before
> converting. There's really no reason to accept a negative value for
> the M type.
>
> Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>

Reviewed-by: Markus Armbruster <armbru@redhat.com>
diff mbox

Patch

diff --git a/monitor.c b/monitor.c
index 56ee971..9e08fa2 100644
--- a/monitor.c
+++ b/monitor.c
@@ -89,8 +89,8 @@ 
  *              TODO lift the restriction
  * 'i'          32 bit integer
  * 'l'          target long (32 or 64 bit)
- * 'M'          just like 'l', except in user mode the value is
- *              multiplied by 2^20 (think Mebibyte)
+ * 'M'          Non-negative target long (32 or 64 bit), in user mode the
+ *              value is multiplied by 2^20 (think Mebibyte)
  * 'o'          octets (aka bytes)
  *              user mode accepts an optional T, t, G, g, M, m, K, k
  *              suffix, which multiplies the value by 2^40 for
@@ -3625,6 +3625,10 @@  static const mon_cmd_t *monitor_parse_command(Monitor *mon,
                     monitor_printf(mon, "integer is for 32-bit values\n");
                     goto fail;
                 } else if (c == 'M') {
+                    if (val < 0) {
+                        monitor_printf(mon, "enter a positive value\n");
+                        goto fail;
+                    }
                     val <<= 20;
                 }
                 qdict_put(qdict, key, qint_from_int(val));