From patchwork Fri Jul 3 07:28:49 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bo Tu X-Patchwork-Id: 490933 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [IPv6:2001:4830:134:3::11]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 946AA140775 for ; Fri, 3 Jul 2015 17:30:44 +1000 (AEST) Received: from localhost ([::1]:39662 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZAvQo-0003mQ-NH for incoming@patchwork.ozlabs.org; Fri, 03 Jul 2015 03:30:42 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:36658) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZAvQ6-0002Xr-Sa for qemu-devel@nongnu.org; Fri, 03 Jul 2015 03:30:02 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ZAvQ3-0001pU-Bf for qemu-devel@nongnu.org; Fri, 03 Jul 2015 03:29:58 -0400 Received: from e28smtp03.in.ibm.com ([122.248.162.3]:40099) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZAvQ2-0001ns-Nk for qemu-devel@nongnu.org; Fri, 03 Jul 2015 03:29:55 -0400 Received: from /spool/local by e28smtp03.in.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Fri, 3 Jul 2015 12:59:50 +0530 Received: from d28dlp01.in.ibm.com (9.184.220.126) by e28smtp03.in.ibm.com (192.168.1.133) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; Fri, 3 Jul 2015 12:59:48 +0530 X-Helo: d28dlp01.in.ibm.com X-MailFrom: tubo@linux.vnet.ibm.com X-RcptTo: qemu-devel@nongnu.org Received: from d28relay03.in.ibm.com (d28relay03.in.ibm.com [9.184.220.60]) by d28dlp01.in.ibm.com (Postfix) with ESMTP id 5C2BCE006D for ; Fri, 3 Jul 2015 13:03:19 +0530 (IST) Received: from d28av05.in.ibm.com (d28av05.in.ibm.com [9.184.220.67]) by d28relay03.in.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id t637TXm07405868 for ; Fri, 3 Jul 2015 12:59:34 +0530 Received: from d28av05.in.ibm.com (localhost [127.0.0.1]) by d28av05.in.ibm.com (8.14.4/8.14.4/NCO v10.0 AVout) with ESMTP id t637TWHj024914 for ; Fri, 3 Jul 2015 12:59:32 +0530 Received: from oc6333346435.ibm.com ([9.115.114.37]) by d28av05.in.ibm.com (8.14.4/8.14.4/NCO v10.0 AVin) with ESMTP id t637TNV2024190; Fri, 3 Jul 2015 12:59:29 +0530 From: Bo Tu To: kwolf@redhat.com Date: Fri, 3 Jul 2015 15:28:49 +0800 Message-Id: <1435908530-25980-5-git-send-email-tubo@linux.vnet.ibm.com> X-Mailer: git-send-email 1.7.1 In-Reply-To: <1435908530-25980-1-git-send-email-tubo@linux.vnet.ibm.com> References: <1435908530-25980-1-git-send-email-tubo@linux.vnet.ibm.com> X-TM-AS-MML: disable X-Content-Scanned: Fidelis XPS MAILER x-cbid: 15070307-0009-0000-0000-0000064C3AB7 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x X-Received-From: 122.248.162.3 Cc: silbe@linux.vnet.ibm.com, mreitz@redhat.com, mimu@linux.vnet.ibm.com, qemu-devel@nongnu.org, armbru@redhat.com Subject: [Qemu-devel] [PATCH v11 4/5] qemu-iotests: s390x: fix test 049, reject negative sizes in QemuOpts X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org when creating an image qemu-img enable us specifying the size of the image using -o size=xx options. But when we specify an invalid size such as a negtive size then different platform gives different result. parse_option_size() function in util/qemu-option.c will be called to parse the size, a cast was called in the function to cast the input (saved as a double in the function) size to an unsigned int64 value, when the input is a negtive value or exceeds the maximum of uint64, then the result is undefined. According to C99 6.3.1.4, the result of converting a floating point number to an integer that cannot represent the (integer part of) number is undefined. And sure enough the results are different on x86 and s390. C99 Language spec 6.3.1.4 Real floating and integers: the result of this assignment/cast is undefined if the float is not in the open interval (-1, U_MAX+1). Reviewed-by: Max Reitz Reviewed-by: Sascha Silbe Signed-off-by: Bo Tu --- tests/qemu-iotests/049.out | 10 ++++------ util/qemu-option.c | 5 +++++ 2 files changed, 9 insertions(+), 6 deletions(-) diff --git a/tests/qemu-iotests/049.out b/tests/qemu-iotests/049.out index 9f93666..8884543 100644 --- a/tests/qemu-iotests/049.out +++ b/tests/qemu-iotests/049.out @@ -95,17 +95,15 @@ qemu-img create -f qcow2 TEST_DIR/t.qcow2 -- -1024 qemu-img: Image size must be less than 8 EiB! qemu-img create -f qcow2 -o size=-1024 TEST_DIR/t.qcow2 -qemu-img: qcow2 doesn't support shrinking images yet -qemu-img: TEST_DIR/t.qcow2: Could not resize image: Operation not supported -Formatting 'TEST_DIR/t.qcow2', fmt=qcow2 size=-1024 encryption=off cluster_size=65536 lazy_refcounts=off refcount_bits=16 +qemu-img: Parameter 'size' expects a non-negative number below 2^64 +qemu-img: TEST_DIR/t.qcow2: Invalid options for file format 'qcow2' qemu-img create -f qcow2 TEST_DIR/t.qcow2 -- -1k qemu-img: Image size must be less than 8 EiB! qemu-img create -f qcow2 -o size=-1k TEST_DIR/t.qcow2 -qemu-img: qcow2 doesn't support shrinking images yet -qemu-img: TEST_DIR/t.qcow2: Could not resize image: Operation not supported -Formatting 'TEST_DIR/t.qcow2', fmt=qcow2 size=-1024 encryption=off cluster_size=65536 lazy_refcounts=off refcount_bits=16 +qemu-img: Parameter 'size' expects a non-negative number below 2^64 +qemu-img: TEST_DIR/t.qcow2: Invalid options for file format 'qcow2' qemu-img create -f qcow2 TEST_DIR/t.qcow2 -- 1kilobyte qemu-img: Invalid image size specified! You may use k, M, G, T, P or E suffixes for diff --git a/util/qemu-option.c b/util/qemu-option.c index efe9d27..efd6f02 100644 --- a/util/qemu-option.c +++ b/util/qemu-option.c @@ -180,6 +180,11 @@ void parse_option_size(const char *name, const char *value, if (value != NULL) { sizef = strtod(value, &postfix); + if (sizef < 0 || sizef > UINT64_MAX) { + error_setg(errp, QERR_INVALID_PARAMETER_VALUE, name, + "a non-negative number below 2^64"); + return; + } switch (*postfix) { case 'T': sizef *= 1024;