Re: [Xen-devel] [PATCH v2] libxc: fix out of range shift in populate_acpi_pages

[Wei Liu <wei.liu2@xxxxxxxxxx>]

On Wed, Sep 28, 2016 at 04:38:19PM +0100, Wei Liu wrote:
> unsigned int is only 4-byte long and "4" is treated as int. The shift
> would overflow.
> 
> Use unsigned long type, calculate the bits to shift before shifting
> instead of shifting twice.
> 
> Caught by clang compilation test.
> 
> Signed-off-by: Wei Liu <wei.liu2@xxxxxxxxxx>
> ---
> Cc: Ian Jackson <ian.jackson@xxxxxxxxxxxxx>
> Cc: Boris Ostrovsky <boris.ostrovsky@xxxxxxxxxx>
> ---
>  tools/libxc/xc_dom_core.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/tools/libxc/xc_dom_core.c b/tools/libxc/xc_dom_core.c
> index 87b450c..5884cdb 100644
> --- a/tools/libxc/xc_dom_core.c
> +++ b/tools/libxc/xc_dom_core.c
> @@ -1048,7 +1048,7 @@ static int populate_acpi_pages(struct xc_dom_image *dom,
>      xc_interface *xch = dom->xch;
>      uint32_t domid = dom->guest_domid;
>      unsigned long idx;
> -    unsigned int first_high_idx = (4 << 30) >> PAGE_SHIFT; /* 4GB */
> +    unsigned long first_high_idx = 4UL << (30 - PAGE_SHIFT); /* 4GB */
>  

Ian replied on IRC "LGTM", so I've translated that to an ack and pushed
this patch to staging.

Wei.

>      for ( ; num_pages; num_pages--, extents++ )
>      {
> -- 
> 2.1.4
> 

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
https://lists.xen.org/xen-devel