vl.c: numa_add(): Validate nodeid before using it
Without this check, QEMU will corrupt memory if a too-large nodeid is provided in the command-line. e.g.: -numa node,mem=...,cpus=...,nodeid=65 This changes nodenr to unsigned long long, to avoid integer conversion issues when converting the strtoull() result to int. Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
This commit is contained in:
parent
ca4c6d3631
commit
e4ce85b258
7
vl.c
7
vl.c
@ -1249,7 +1249,7 @@ static void numa_add(const char *optarg)
|
||||
char option[128];
|
||||
char *endptr;
|
||||
unsigned long long value, endvalue;
|
||||
int nodenr;
|
||||
unsigned long long nodenr;
|
||||
|
||||
value = endvalue = 0ULL;
|
||||
|
||||
@ -1270,6 +1270,11 @@ static void numa_add(const char *optarg)
|
||||
nodenr = strtoull(option, NULL, 10);
|
||||
}
|
||||
|
||||
if (nodenr >= MAX_NODES) {
|
||||
fprintf(stderr, "qemu: invalid NUMA nodeid: %llu\n", nodenr);
|
||||
exit(1);
|
||||
}
|
||||
|
||||
if (get_param_value(option, 128, "mem", optarg) == 0) {
|
||||
node_mem[nodenr] = 0;
|
||||
} else {
|
||||
|
Loading…
Reference in New Issue
Block a user