[PATCH v2] libxc: fix out of range shift in populate_acpi_pages

[PATCH v2] libxc: fix out of range shift in populate_acpi_pages

[Wei Liu]

unsigned int is only 4-byte long and "4" is treated as int. The shift
would overflow.

Use unsigned long type, calculate the bits to shift before shifting
instead of shifting twice.

Caught by clang compilation test.

Signed-off-by: Wei Liu <wei.liu2@citrix.com>
---
Cc: Ian Jackson <ian.jackson@eu.citrix.com>
Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
---
 tools/libxc/xc_dom_core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/libxc/xc_dom_core.c b/tools/libxc/xc_dom_core.c
index 87b450c..5884cdb 100644
--- a/tools/libxc/xc_dom_core.c
+++ b/tools/libxc/xc_dom_core.c
@@ -1048,7 +1048,7 @@ static int populate_acpi_pages(struct xc_dom_image *dom,
     xc_interface *xch = dom->xch;
     uint32_t domid = dom->guest_domid;
     unsigned long idx;
-    unsigned int first_high_idx = (4 << 30) >> PAGE_SHIFT; /* 4GB */
+    unsigned long first_high_idx = 4UL << (30 - PAGE_SHIFT); /* 4GB */
 
     for ( ; num_pages; num_pages--, extents++ )
     {
-- 
2.1.4


_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel

Re: [PATCH v2] libxc: fix out of range shift in populate_acpi_pages

[Wei Liu]

On Wed, Sep 28, 2016 at 04:38:19PM +0100, Wei Liu wrote:
> unsigned int is only 4-byte long and "4" is treated as int. The shift
> would overflow.
> 
> Use unsigned long type, calculate the bits to shift before shifting
> instead of shifting twice.
> 
> Caught by clang compilation test.
> 
> Signed-off-by: Wei Liu <wei.liu2@citrix.com>
> ---
> Cc: Ian Jackson <ian.jackson@eu.citrix.com>
> Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
> ---
>  tools/libxc/xc_dom_core.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/tools/libxc/xc_dom_core.c b/tools/libxc/xc_dom_core.c
> index 87b450c..5884cdb 100644
> --- a/tools/libxc/xc_dom_core.c
> +++ b/tools/libxc/xc_dom_core.c
> @@ -1048,7 +1048,7 @@ static int populate_acpi_pages(struct xc_dom_image *dom,
>      xc_interface *xch = dom->xch;
>      uint32_t domid = dom->guest_domid;
>      unsigned long idx;
> -    unsigned int first_high_idx = (4 << 30) >> PAGE_SHIFT; /* 4GB */
> +    unsigned long first_high_idx = 4UL << (30 - PAGE_SHIFT); /* 4GB */
>  

Ian replied on IRC "LGTM", so I've translated that to an ack and pushed
this patch to staging.

Wei.

>      for ( ; num_pages; num_pages--, extents++ )
>      {
> -- 
> 2.1.4
> 

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel