From e4ce85b25838694d2d7396b5e969eb4830329631 Mon Sep 17 00:00:00 2001 From: Eduardo Habkost Date: Mon, 4 Feb 2013 16:27:49 -0200 Subject: vl.c: numa_add(): Validate nodeid before using it Without this check, QEMU will corrupt memory if a too-large nodeid is provided in the command-line. e.g.: -numa node,mem=...,cpus=...,nodeid=65 This changes nodenr to unsigned long long, to avoid integer conversion issues when converting the strtoull() result to int. Signed-off-by: Eduardo Habkost Reviewed-by: Eric Blake Signed-off-by: Anthony Liguori --- vl.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) (limited to 'vl.c') diff --git a/vl.c b/vl.c index 89de003..4955c29 100644 --- a/vl.c +++ b/vl.c @@ -1249,7 +1249,7 @@ static void numa_add(const char *optarg) char option[128]; char *endptr; unsigned long long value, endvalue; - int nodenr; + unsigned long long nodenr; value = endvalue = 0ULL; @@ -1270,6 +1270,11 @@ static void numa_add(const char *optarg) nodenr = strtoull(option, NULL, 10); } + if (nodenr >= MAX_NODES) { + fprintf(stderr, "qemu: invalid NUMA nodeid: %llu\n", nodenr); + exit(1); + } + if (get_param_value(option, 128, "mem", optarg) == 0) { node_mem[nodenr] = 0; } else { -- cgit v1.1