diff options
author | Eduardo Habkost <ehabkost@redhat.com> | 2013-02-04 16:27:49 -0200 |
---|---|---|
committer | Anthony Liguori <aliguori@us.ibm.com> | 2013-02-04 14:38:33 -0600 |
commit | e4ce85b25838694d2d7396b5e969eb4830329631 (patch) | |
tree | 6721d9965482bb305cbaf943f55c584ef7237037 /vl.c | |
parent | ca4c6d363153f19abf3ffdf0ca1532daa581867d (diff) | |
download | qemu-e4ce85b25838694d2d7396b5e969eb4830329631.zip qemu-e4ce85b25838694d2d7396b5e969eb4830329631.tar.gz qemu-e4ce85b25838694d2d7396b5e969eb4830329631.tar.bz2 |
vl.c: numa_add(): Validate nodeid before using it
Without this check, QEMU will corrupt memory if a too-large nodeid is
provided in the command-line. e.g.:
-numa node,mem=...,cpus=...,nodeid=65
This changes nodenr to unsigned long long, to avoid integer conversion
issues when converting the strtoull() result to int.
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Diffstat (limited to 'vl.c')
-rw-r--r-- | vl.c | 7 |
1 files changed, 6 insertions, 1 deletions
@@ -1249,7 +1249,7 @@ static void numa_add(const char *optarg) char option[128]; char *endptr; unsigned long long value, endvalue; - int nodenr; + unsigned long long nodenr; value = endvalue = 0ULL; @@ -1270,6 +1270,11 @@ static void numa_add(const char *optarg) nodenr = strtoull(option, NULL, 10); } + if (nodenr >= MAX_NODES) { + fprintf(stderr, "qemu: invalid NUMA nodeid: %llu\n", nodenr); + exit(1); + } + if (get_param_value(option, 128, "mem", optarg) == 0) { node_mem[nodenr] = 0; } else { |