diff options
| author | David Gibson <david@gibson.dropbear.id.au> | 2011-09-14 17:02:49 +1000 |
|---|---|---|
| committer | Avi Kivity <avi@redhat.com> | 2011-09-14 11:21:58 +0300 |
| commit | d2963631dd54ddf0f46c151b7e3013e39bb78d3b (patch) | |
| tree | 79e84a7e8a018d11d72c2aaf40345c31603c4db0 /hw/mst_fpga.c | |
| parent | 44520db10b1b92f272348ab7028e7afc68ac3edf (diff) | |
| download | focaccia-qemu-d2963631dd54ddf0f46c151b7e3013e39bb78d3b.tar.gz focaccia-qemu-d2963631dd54ddf0f46c151b7e3013e39bb78d3b.zip | |
Fix subtle integer overflow bug in memory API
It is quite common to have a MemoryRegion with size of INT64_MAX.
When processing alias regions in render_memory_region() it's quite
easy to find a case where it will construct a temporary AddrRange with
a non-zero start, and size still of INT64_MAX. When means attempting
to compute the end of such a range as start + size will result in
signed integer overflow.
This integer overflow means that addrrange_intersects() can
incorrectly report regions as not intersecting when they do. For
example consider the case of address ranges {0x10000000000,
0x7fffffffffffffff} and {0x10010000000, 0x10000000} where the second
is in fact included completely in the first.
This patch rearranges addrrange_intersects() to avoid the integer
overflow, correcting this behaviour.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Avi Kivity <avi@redhat.com>
Diffstat (limited to 'hw/mst_fpga.c')
0 files changed, 0 insertions, 0 deletions