From: Paul Durrant <paul.durrant@citrix.com> To: qemu-devel@nongnu.org, qemu-block@nongnu.org, xen-devel@lists.xenproject.org Cc: Paul Durrant <paul.durrant@citrix.com>, Peter Maydell <peter.maydell@linaro.org>, Stefano Stabellini <sstabellini@kernel.org>, Anthony Perard <anthony.perard@citrix.com>, Kevin Wolf <kwolf@redhat.com>, Max Reitz <mreitz@redhat.com> Subject: [Qemu-devel] [PATCH 3/3] xen-block: report error condition from vbd_name_to_disk() Date: Fri, 15 Feb 2019 16:25:33 +0000 [thread overview] Message-ID: <20190215162533.19475-4-paul.durrant@citrix.com> (raw) In-Reply-To: <20190215162533.19475-1-paul.durrant@citrix.com> The function needs to make sure it is passed a valid disk name. This is easily done by making sure that the parsing loop results in a non-zero value. Spotted by Coverity: CID 1398640 Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Paul Durrant <paul.durrant@citrix.com> --- Cc: Stefano Stabellini <sstabellini@kernel.org> Cc: Anthony Perard <anthony.perard@citrix.com> Cc: Kevin Wolf <kwolf@redhat.com> Cc: Max Reitz <mreitz@redhat.com> --- hw/block/xen-block.c | 21 +++++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-) diff --git a/hw/block/xen-block.c b/hw/block/xen-block.c index 29afe2703a..37a456c207 100644 --- a/hw/block/xen-block.c +++ b/hw/block/xen-block.c @@ -351,21 +351,28 @@ static void xen_block_get_vdev(Object *obj, Visitor *v, const char *name, g_free(str); } -static unsigned int vbd_name_to_disk(const char *name, const char **endp) +static int vbd_name_to_disk(const char *name, const char **endp, + unsigned long *disk) { - unsigned int disk = 0; + unsigned int n = 0; while (*name != '\0') { if (!g_ascii_isalpha(*name) || !g_ascii_islower(*name)) { break; } - disk *= 26; - disk += *name++ - 'a' + 1; + n *= 26; + n += *name++ - 'a' + 1; } *endp = name; - return disk - 1; + if (!n) { + return -1; + } + + *disk = n - 1; + + return 0; } static void xen_block_set_vdev(Object *obj, Visitor *v, const char *name, @@ -418,7 +425,9 @@ static void xen_block_set_vdev(Object *obj, Visitor *v, const char *name, } } } else { - vdev->disk = vbd_name_to_disk(p, &end); + if (vbd_name_to_disk(p, &end, &vdev->disk)) { + goto invalid; + } } if (*end != '\0') { -- 2.20.1.2.gb21ebb6
WARNING: multiple messages have this Message-ID (diff)
From: Paul Durrant <paul.durrant@citrix.com> To: qemu-devel@nongnu.org, qemu-block@nongnu.org, xen-devel@lists.xenproject.org Cc: Kevin Wolf <kwolf@redhat.com>, Peter Maydell <peter.maydell@linaro.org>, Stefano Stabellini <sstabellini@kernel.org>, Max Reitz <mreitz@redhat.com>, Paul Durrant <paul.durrant@citrix.com>, Anthony Perard <anthony.perard@citrix.com> Subject: [PATCH 3/3] xen-block: report error condition from vbd_name_to_disk() Date: Fri, 15 Feb 2019 16:25:33 +0000 [thread overview] Message-ID: <20190215162533.19475-4-paul.durrant@citrix.com> (raw) In-Reply-To: <20190215162533.19475-1-paul.durrant@citrix.com> The function needs to make sure it is passed a valid disk name. This is easily done by making sure that the parsing loop results in a non-zero value. Spotted by Coverity: CID 1398640 Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Paul Durrant <paul.durrant@citrix.com> --- Cc: Stefano Stabellini <sstabellini@kernel.org> Cc: Anthony Perard <anthony.perard@citrix.com> Cc: Kevin Wolf <kwolf@redhat.com> Cc: Max Reitz <mreitz@redhat.com> --- hw/block/xen-block.c | 21 +++++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-) diff --git a/hw/block/xen-block.c b/hw/block/xen-block.c index 29afe2703a..37a456c207 100644 --- a/hw/block/xen-block.c +++ b/hw/block/xen-block.c @@ -351,21 +351,28 @@ static void xen_block_get_vdev(Object *obj, Visitor *v, const char *name, g_free(str); } -static unsigned int vbd_name_to_disk(const char *name, const char **endp) +static int vbd_name_to_disk(const char *name, const char **endp, + unsigned long *disk) { - unsigned int disk = 0; + unsigned int n = 0; while (*name != '\0') { if (!g_ascii_isalpha(*name) || !g_ascii_islower(*name)) { break; } - disk *= 26; - disk += *name++ - 'a' + 1; + n *= 26; + n += *name++ - 'a' + 1; } *endp = name; - return disk - 1; + if (!n) { + return -1; + } + + *disk = n - 1; + + return 0; } static void xen_block_set_vdev(Object *obj, Visitor *v, const char *name, @@ -418,7 +425,9 @@ static void xen_block_set_vdev(Object *obj, Visitor *v, const char *name, } } } else { - vdev->disk = vbd_name_to_disk(p, &end); + if (vbd_name_to_disk(p, &end, &vdev->disk)) { + goto invalid; + } } if (*end != '\0') { -- 2.20.1.2.gb21ebb6 _______________________________________________ Xen-devel mailing list Xen-devel@lists.xenproject.org https://lists.xenproject.org/mailman/listinfo/xen-devel
next prev parent reply other threads:[~2019-02-15 16:26 UTC|newest] Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top 2019-02-15 16:25 [Qemu-devel] [PATCH 0/3] Coverity fixes Paul Durrant 2019-02-15 16:25 ` Paul Durrant 2019-02-15 16:25 ` [Qemu-devel] [PATCH 1/3] dataplane/xen-block: remove dead code Paul Durrant 2019-02-15 16:25 ` Paul Durrant 2019-02-15 20:38 ` [Qemu-devel] " Philippe Mathieu-Daudé 2019-02-18 14:27 ` Anthony PERARD 2019-02-18 14:27 ` Anthony PERARD 2019-02-15 20:38 ` Philippe Mathieu-Daudé 2019-02-15 16:25 ` [PATCH 2/3] xen-block: remove redundant assignment Paul Durrant 2019-02-15 16:25 ` [Qemu-devel] " Paul Durrant 2019-02-18 14:43 ` Anthony PERARD 2019-02-18 14:43 ` Anthony PERARD 2019-02-15 16:25 ` Paul Durrant [this message] 2019-02-15 16:25 ` [PATCH 3/3] xen-block: report error condition from vbd_name_to_disk() Paul Durrant 2019-02-18 15:43 ` [Qemu-devel] " Anthony PERARD 2019-02-18 15:43 ` Anthony PERARD
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20190215162533.19475-4-paul.durrant@citrix.com \ --to=paul.durrant@citrix.com \ --cc=anthony.perard@citrix.com \ --cc=kwolf@redhat.com \ --cc=mreitz@redhat.com \ --cc=peter.maydell@linaro.org \ --cc=qemu-block@nongnu.org \ --cc=qemu-devel@nongnu.org \ --cc=sstabellini@kernel.org \ --cc=xen-devel@lists.xenproject.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.