Re: [PATCH] monitor/hmp: detect signed integer overflow in expression evaluator

[Markus Armbruster <armbru@redhat.com>]

Bin Guo <guobin@linux.alibaba.com> writes:

> The HMP expression evaluator performed *, +, - and unary - on int64_t
> values without checking for overflow.  A malformed expression such as
> "0x7fffffffffffffff + 1" would silently wrap around to INT64_MIN and
> could then be passed as a physical address to the "xp" command.

Isn't that a feature?

It wraps to (int64_t)0x8000000000000000, is put in the argument QDict,
passed to hmp_physical_memory_dump(), which implicitly converts to
uint64_t, then passes to memory_dump().  Such cavalier signedness
conversions are endemic in old C code like this.

The same conversions happen when you write the expression as
"0x8000000000000000" instead.

[...]