Re: [Xen-devel] [PATCH] libxc: fix out of range shift in populate_acpi_pages

[Wei Liu <wei.liu2@xxxxxxxxxx>]

On Wed, Sep 28, 2016 at 11:22:10AM -0400, Boris Ostrovsky wrote:
> On 09/28/2016 11:02 AM, Wei Liu wrote:
> > "unsigned int" is only 4-byte long and "4" is treated as int. The shift
> > would overflow.  Use "unsigned long" (to match the type of idx) and
> > "4UL" instead.
> >
> > Caught by clang compilation test.
> >
> > Signed-off-by: Wei Liu <wei.liu2@xxxxxxxxxx>
> 
> Reviewed-by: Boris Ostrovsky <boris.ostrovsky@xxxxxxxxxx>
> 
> > ---
> > Cc: Ian Jackson <ian.jackson@xxxxxxxxxxxxx>
> > Cc: Boris Ostrovsky <boris.ostrovsky@xxxxxxxxxx>
> > ---
> >  tools/libxc/xc_dom_core.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/tools/libxc/xc_dom_core.c b/tools/libxc/xc_dom_core.c
> > index 87b450c..b3feb42 100644
> > --- a/tools/libxc/xc_dom_core.c
> > +++ b/tools/libxc/xc_dom_core.c
> > @@ -1048,7 +1048,7 @@ static int populate_acpi_pages(struct xc_dom_image 
> > *dom,
> >      xc_interface *xch = dom->xch;
> >      uint32_t domid = dom->guest_domid;
> >      unsigned long idx;
> > -    unsigned int first_high_idx = (4 << 30) >> PAGE_SHIFT; /* 4GB */
> > +    unsigned long first_high_idx = (4UL << 30) >> PAGE_SHIFT; /* 4GB */
> >  

Actually, Ian pointed out on IRC unsigned long is 32 bit on i386, so
this patch is not enough.

Will try again.

Wei.

> >      for ( ; num_pages; num_pages--, extents++ )
> >      {
> 

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
https://lists.xen.org/xen-devel