From c58e1f4de2e120c124fb008629c05de03f72b2ca Mon Sep 17 00:00:00 2001
From: Peter Krempa <pkrempa@redhat.com>
Date: Tue, 22 Jan 2013 15:27:04 +0100
Subject: [PATCH] conf: Check if number of vCPUs fits in the storage variable

The count of vCPUs for a domain is extracted as a usingned long variable
but is stored in a unsigned short. If the actual number was too large,
a faulty number was stored.
---
 src/conf/domain_conf.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
index 7640af7888..26e0b8eb6e 100644
--- a/src/conf/domain_conf.c
+++ b/src/conf/domain_conf.c
@@ -9085,7 +9085,7 @@ static virDomainDefPtr virDomainDefParseXML(virCapsPtr caps,
         def->maxvcpus = 1;
     } else {
         def->maxvcpus = count;
-        if (count == 0) {
+        if (count == 0 || (unsigned short) count != count) {
             virReportError(VIR_ERR_XML_ERROR,
                            _("invalid maxvcpus %lu"), count);
             goto error;
@@ -9101,7 +9101,7 @@ static virDomainDefPtr virDomainDefParseXML(virCapsPtr caps,
         def->vcpus = def->maxvcpus;
     } else {
         def->vcpus = count;
-        if (count == 0) {
+        if (count == 0 || (unsigned short) count != count) {
             virReportError(VIR_ERR_XML_ERROR,
                            _("invalid current vcpus %lu"), count);
             goto error;