From patchwork Mon Feb 4 18:27:49 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eduardo Habkost X-Patchwork-Id: 218026 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (Client did not present a certificate) by ozlabs.org (Postfix) with ESMTPS id EDDA72C02B3 for ; Tue, 5 Feb 2013 05:26:34 +1100 (EST) Received: from localhost ([::1]:41060 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1U2QkS-0006yE-P1 for incoming@patchwork.ozlabs.org; Mon, 04 Feb 2013 13:26:32 -0500 Received: from eggs.gnu.org ([208.118.235.92]:52512) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1U2QkC-0006x8-IV for qemu-devel@nongnu.org; Mon, 04 Feb 2013 13:26:19 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1U2QkB-0002u1-I5 for qemu-devel@nongnu.org; Mon, 04 Feb 2013 13:26:16 -0500 Received: from mx1.redhat.com ([209.132.183.28]:4560) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1U2QkB-0002tf-BE for qemu-devel@nongnu.org; Mon, 04 Feb 2013 13:26:15 -0500 Received: from int-mx12.intmail.prod.int.phx2.redhat.com (int-mx12.intmail.prod.int.phx2.redhat.com [10.5.11.25]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id r14IQDKR026770 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Mon, 4 Feb 2013 13:26:13 -0500 Received: from blackpad.lan.raisama.net (vpn1-7-242.gru2.redhat.com [10.97.7.242]) by int-mx12.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id r14IQBMF021453; Mon, 4 Feb 2013 13:26:12 -0500 Received: by blackpad.lan.raisama.net (Postfix, from userid 500) id 72926201BF8; Mon, 4 Feb 2013 16:27:59 -0200 (BRST) From: Eduardo Habkost To: Anthony Liguori , qemu-devel@nongnu.org Date: Mon, 4 Feb 2013 16:27:49 -0200 Message-Id: <1360002472-17628-6-git-send-email-ehabkost@redhat.com> In-Reply-To: <1360002472-17628-1-git-send-email-ehabkost@redhat.com> References: <1360002472-17628-1-git-send-email-ehabkost@redhat.com> X-Scanned-By: MIMEDefang 2.68 on 10.5.11.25 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x X-Received-From: 209.132.183.28 Cc: Laszlo Ersek Subject: [Qemu-devel] [PATCH 5/8] vl.c: numa_add(): Validate nodeid before using it X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Without this check, QEMU will corrupt memory if a too-large nodeid is provided in the command-line. e.g.: -numa node,mem=...,cpus=...,nodeid=65 This changes nodenr to unsigned long long, to avoid integer conversion issues when converting the strtoull() result to int. Signed-off-by: Eduardo Habkost Reviewed-by: Eric Blake --- vl.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/vl.c b/vl.c index 89de003..4955c29 100644 --- a/vl.c +++ b/vl.c @@ -1249,7 +1249,7 @@ static void numa_add(const char *optarg) char option[128]; char *endptr; unsigned long long value, endvalue; - int nodenr; + unsigned long long nodenr; value = endvalue = 0ULL; @@ -1270,6 +1270,11 @@ static void numa_add(const char *optarg) nodenr = strtoull(option, NULL, 10); } + if (nodenr >= MAX_NODES) { + fprintf(stderr, "qemu: invalid NUMA nodeid: %llu\n", nodenr); + exit(1); + } + if (get_param_value(option, 128, "mem", optarg) == 0) { node_mem[nodenr] = 0; } else {