Re: [Qemu-devel] [PATCH 1/2] hmp: expr_unary(): check for overflow in strtoul()/strtoull()

[Markus Armbruster]

Luiz Capitulino <address@hidden> writes:

> It's not checked currently, so something like:
>
>   (qemu) balloon -100000000000001111114334234
>   (qemu)
>
> Will just "work" (in this case the balloon command will get a random
> value).
>
> Fix it by checking if strtoul()/strtoull() overflowed.
>
> Signed-off-by: Luiz Capitulino <address@hidden>
> ---
>  monitor.c |    7 +++++++
>  1 file changed, 7 insertions(+)
>
> diff --git a/monitor.c b/monitor.c
> index 8946a10..56ee971 100644
> --- a/monitor.c
> +++ b/monitor.c
> @@ -3120,10 +3120,17 @@ static int64_t expr_unary(Monitor *mon)
>          n = 0;
>          break;
>      default:
> +        errno = 0;
>  #if TARGET_PHYS_ADDR_BITS > 32
>          n = strtoull(pch, &p, 0);
> +        if (n == ULLONG_MAX && errno == ERANGE) {
> +            expr_error(mon, "number too large");
> +        }

The test n == ULLONG_MAX is redundant.

You silently interpret a string that doesn't parse as zero.

Failure modes of strtol() & friends:

1. String is empty or doesn't have the expected form

   Test: p == pch

2. String has the expected form, but number overflows result

   Test: errno == ERANGE (need to errno = 0 before the call)

3. String has the expected form, but there's junk after the number

   Test: p != pch && "*pch isn't in the follow set"

   Many places in QEMU silently ignore trailing junk, so not checking
   this could be excused.

>  #else
>          n = strtoul(pch, &p, 0);
> +        if (n == ULONG_MAX && errno == ERANGE) {
> +            expr_error(mon, "number too large");
> +        }
>  #endif
>          if (pch == p) {
>              expr_error(mon, "invalid char in expression");