From 2f0944dec1caf0ae842f28bb4e739417244210a0 Mon Sep 17 00:00:00 2001 From: Erik Skultety Date: Tue, 26 Aug 2014 13:29:10 +0200 Subject: [PATCH] blkdeviotune: check for overflow when parsing XML According to docs/schemas/domaincommon.rng and _virDomainBlockIoTuneInfo all the iotune values are interpreted as unsigned long long, however according to qemu_monitor_json.c, qemu silently truncates numbers larger than LLONG_MAX. There's really not much of a usage for such large numbers anyway yet. This patch provides the same overflow check during a domain start as it does during setting a blkdeviotune element in qemu_driver.c and thus reports an error when a larger number than LLONG_MAX is detected. https://bugzilla.redhat.com/show_bug.cgi?id=1131876 --- src/qemu/qemu_command.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index 35ff8f2f03..9241f57af6 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -3620,6 +3620,18 @@ qemuBuildDriveStr(virConnectPtr conn, goto error; } + if (disk->blkdeviotune.total_bytes_sec > LLONG_MAX || + disk->blkdeviotune.read_bytes_sec > LLONG_MAX || + disk->blkdeviotune.write_bytes_sec > LLONG_MAX || + disk->blkdeviotune.total_iops_sec > LLONG_MAX || + disk->blkdeviotune.read_iops_sec > LLONG_MAX || + disk->blkdeviotune.write_iops_sec > LLONG_MAX) { + virReportError(VIR_ERR_OVERFLOW, + _("block I/O throttle limit must " + "be less than %llu using QEMU"), LLONG_MAX); + goto error; + } + if (disk->blkdeviotune.total_bytes_sec) { virBufferAsprintf(&opt, ",bps=%llu", disk->blkdeviotune.total_bytes_sec);