From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:43535) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VmHsy-00027g-2a for qemu-devel@nongnu.org; Fri, 29 Nov 2013 01:49:14 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1VmHss-0003KF-3B for qemu-devel@nongnu.org; Fri, 29 Nov 2013 01:49:08 -0500 Received: from cantor2.suse.de ([195.135.220.15]:56550 helo=mx2.suse.de) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VmHsr-0003KB-Pi for qemu-devel@nongnu.org; Fri, 29 Nov 2013 01:49:02 -0500 From: Hannes Reinecke Date: Fri, 29 Nov 2013 07:48:55 +0100 Message-Id: <1385707735-6994-1-git-send-email-hare@suse.de> Subject: [Qemu-devel] [PATCHv4] qdev: Validate hex properties List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Andreas Faerber Cc: qemu-devel@nongnu.org, Hannes Reinecke strtoul(l) might overflow, in which case it'll return '-1' and set the appropriate error code. So update the calls to strtoul(l) when parsing hex properties to avoid silent overflows. And we should be using an intermediate variable to avoid clobbering of the passed-in point on error. Signed-off-by: Hannes Reinecke --- hw/core/qdev-properties.c | 36 ++++++++++++++++++++++++++++++------ 1 file changed, 30 insertions(+), 6 deletions(-) diff --git a/hw/core/qdev-properties.c b/hw/core/qdev-properties.c index dc8ae69..6e4e9f3 100644 --- a/hw/core/qdev-properties.c +++ b/hw/core/qdev-properties.c @@ -191,6 +191,7 @@ PropertyInfo qdev_prop_uint8 = { static int parse_hex8(DeviceState *dev, Property *prop, const char *str) { + unsigned long val; uint8_t *ptr = qdev_get_prop_ptr(dev, prop); char *end; @@ -198,11 +199,18 @@ static int parse_hex8(DeviceState *dev, Property *prop, const char *str) return -EINVAL; } - *ptr = strtoul(str, &end, 16); + errno = 0; + val = strtoul(str, &end, 16); + if (errno) { + return -errno; + } + if (val > UINT8_MAX) { + return -ERANGE; + } if ((*end != '\0') || (end == str)) { return -EINVAL; } - + *ptr = val; return 0; } @@ -322,6 +330,7 @@ PropertyInfo qdev_prop_int32 = { static int parse_hex32(DeviceState *dev, Property *prop, const char *str) { + unsigned long val; uint32_t *ptr = qdev_get_prop_ptr(dev, prop); char *end; @@ -329,11 +338,18 @@ static int parse_hex32(DeviceState *dev, Property *prop, const char *str) return -EINVAL; } - *ptr = strtoul(str, &end, 16); + errno = 0; + val = strtoul(str, &end, 16); + if (errno) { + return -errno; + } + if (val > UINT32_MAX) { + return -ERANGE; + } if ((*end != '\0') || (end == str)) { return -EINVAL; } - + *ptr = val; return 0; } @@ -389,6 +405,7 @@ PropertyInfo qdev_prop_uint64 = { static int parse_hex64(DeviceState *dev, Property *prop, const char *str) { + unsigned long long val; uint64_t *ptr = qdev_get_prop_ptr(dev, prop); char *end; @@ -396,11 +413,18 @@ static int parse_hex64(DeviceState *dev, Property *prop, const char *str) return -EINVAL; } - *ptr = strtoull(str, &end, 16); + errno = 0; + val = strtoull(str, &end, 16); + if (errno) { + return -errno; + } + if (val > UINT64_MAX) { + return -ERANGE; + } if ((*end != '\0') || (end == str)) { return -EINVAL; } - + *ptr = val; return 0; } -- 1.8.1.4