On 07.05.2015 09:52, Bo Tu wrote:
> when creating an image qemu-img enable us specifying the size of the
> image using -o size=xx options. But when we specify an invalid size
> such as a negtive size then different platform gives different result.
>
> parse_option_size() function in util/qemu-option.c will be called to
> parse the size, a cast was called in the function to cast the input
> (saved as a double in the function) size to an unsigned int64 value,
> when the input is a negtive value or exceeds the maximum of uint64, then
> the result is undefined.
>
> Language spec 6.3.1.4 Real floating and integers:
> the result of this assignment/cast is undefined if the float is not
> in the open interval (-1, U<type>_MAX+1).
>
> Signed-off-by: Bo Tu <tubo@linux.vnet.ibm.com>
> ---
>   tests/qemu-iotests/049.out | 10 ++++------
>   util/qemu-option.c         |  4 ++++
>   2 files changed, 8 insertions(+), 6 deletions(-)
>
> diff --git a/tests/qemu-iotests/049.out b/tests/qemu-iotests/049.out
> index 9f93666..b8790f9 100644
> --- a/tests/qemu-iotests/049.out
> +++ b/tests/qemu-iotests/049.out
> @@ -95,17 +95,15 @@ qemu-img create -f qcow2 TEST_DIR/t.qcow2 -- -1024
>   qemu-img: Image size must be less than 8 EiB!
>   
>   qemu-img create -f qcow2 -o size=-1024 TEST_DIR/t.qcow2
> -qemu-img: qcow2 doesn't support shrinking images yet
> -qemu-img: TEST_DIR/t.qcow2: Could not resize image: Operation not supported
> -Formatting 'TEST_DIR/t.qcow2', fmt=qcow2 size=-1024 encryption=off cluster_size=65536 lazy_refcounts=off refcount_bits=16
> +qemu-img: Parameter 'size' expects a non-negative number below 2^64
> +qemu-img: TEST_DIR/t.qcow2: Invalid options for file format 'qcow2'
>   
>   qemu-img create -f qcow2 TEST_DIR/t.qcow2 -- -1k
>   qemu-img: Image size must be less than 8 EiB!
>   
>   qemu-img create -f qcow2 -o size=-1k TEST_DIR/t.qcow2
> -qemu-img: qcow2 doesn't support shrinking images yet
> -qemu-img: TEST_DIR/t.qcow2: Could not resize image: Operation not supported
> -Formatting 'TEST_DIR/t.qcow2', fmt=qcow2 size=-1024 encryption=off cluster_size=65536 lazy_refcounts=off refcount_bits=16
> +qemu-img: Parameter 'size' expects a non-negative number below 2^64
> +qemu-img: TEST_DIR/t.qcow2: Invalid options for file format 'qcow2'
>   
>   qemu-img create -f qcow2 TEST_DIR/t.qcow2 -- 1kilobyte
>   qemu-img: Invalid image size specified! You may use k, M, G, T, P or E suffixes for
> diff --git a/util/qemu-option.c b/util/qemu-option.c
> index fda4e5f..6e75698 100644
> --- a/util/qemu-option.c
> +++ b/util/qemu-option.c
> @@ -179,6 +179,10 @@ void parse_option_size(const char *name, const char *value,
>   
>       if (value != NULL) {
>           sizef = strtod(value, &postfix);
> +        if (sizef < 0 || sizef > UINT64_MAX) {
> +            error_set(errp, QERR_INVALID_PARAMETER_VALUE, name, "a non-negative number below 2^64");

scripts/checkpatch.pl:

Konsole output
> Konsole output
> WARNING: line over 80 characters
> #106: FILE: util/qemu-option.c:183:
> +            error_set(errp, QERR_INVALID_PARAMETER_VALUE, name, "a 
> non-negative number below 2^64");

Other than that, looks good.

Max

> +            return;
> +        }
>           switch (*postfix) {
>           case 'T':
>               sizef *= 1024;