[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 2/9] virtio-balloon: fix integer overflow in memory s
From: |
Luiz Capitulino |
Subject: |
[Qemu-devel] [PULL 2/9] virtio-balloon: fix integer overflow in memory stats feature |
Date: |
Fri, 26 Sep 2014 15:04:00 -0400 |
When a QMP client changes the polling interval time by setting
the guest-stats-polling-interval property, the interval value
is stored and manipulated as an int64_t variable.
However, the balloon_stats_change_timer() function, which is
used to set the actual timer with the interval value, takes
an int instead, causing an overflow for big interval values.
This commit fix this bug by changing balloon_stats_change_timer()
to take an int64_t and also it limits the polling interval value
to UINT_MAX to avoid other kinds of overflow.
Signed-off-by: Luiz Capitulino <address@hidden>
Reviewed-by: Eric Blake <address@hidden>
Reviewed-by: Markus Armbruster <address@hidden>
---
hw/virtio/virtio-balloon.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c
index 2c30b3d..b5cf7ca 100644
--- a/hw/virtio/virtio-balloon.c
+++ b/hw/virtio/virtio-balloon.c
@@ -87,7 +87,7 @@ static void balloon_stats_destroy_timer(VirtIOBalloon *s)
}
}
-static void balloon_stats_change_timer(VirtIOBalloon *s, int secs)
+static void balloon_stats_change_timer(VirtIOBalloon *s, int64_t secs)
{
timer_mod(s->stats_timer, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) + secs *
1000);
}
@@ -170,6 +170,11 @@ static void balloon_stats_set_poll_interval(Object *obj,
struct Visitor *v,
return;
}
+ if (value > UINT_MAX) {
+ error_setg(errp, "timer value is too big");
+ return;
+ }
+
if (value == s->stats_poll_interval) {
return;
}
--
1.9.3
- [Qemu-devel] [PULL 0/9] QMP queue, Luiz Capitulino, 2014/09/26
- [Qemu-devel] [PULL 1/9] monitor: Reset HMP mon->rs in CHR_EVENT_OPEN, Luiz Capitulino, 2014/09/26
- [Qemu-devel] [PULL 3/9] qapi: add visit_start_union and visit_end_union, Luiz Capitulino, 2014/09/26
- [Qemu-devel] [PULL 2/9] virtio-balloon: fix integer overflow in memory stats feature,
Luiz Capitulino <=
- [Qemu-devel] [PULL 5/9] tests: add QMP input visitor test for unions with no discriminator, Luiz Capitulino, 2014/09/26
- [Qemu-devel] [PULL 4/9] qapi: dealloc visitor, implement visit_start_union, Luiz Capitulino, 2014/09/26
- [Qemu-devel] [PULL 7/9] qemu-socket: Polish errors for connect() and listen() failure, Luiz Capitulino, 2014/09/26
- [Qemu-devel] [PULL 6/9] qemu-iotests: Test missing "driver" key for blockdev-add, Luiz Capitulino, 2014/09/26
- [Qemu-devel] [PULL 8/9] qemu-socket: Eliminate silly QERR_ macros, Luiz Capitulino, 2014/09/26
- [Qemu-devel] [PULL 9/9] Add HMP command "info memory-devices", Luiz Capitulino, 2014/09/26
- Re: [Qemu-devel] [PULL 0/9] QMP queue, Peter Maydell, 2014/09/29