[Xen-devel] question about Xen source code (bugreport?)

[George Shuklin <george.shuklin@xxxxxxxxx>]

Good day. 

I digging to Xen sources and found some kind of bug...

xen-3.4.2/tools/blktap ,function:

int convert_dev_name_to_num(char *name) 

It use some extremely strange expressions I could not understand.


           for(i = 0, ptr = alpha; i < strlen(alpha); i++) {
                        if(*ptr == *p) break;
                        *ptr++;
                }
                *p++;


What meaning of *p++? Why not simply p++?

And few lines lower:

ret = (202*256) + (16*i) + atoi(p);   (focus on atoi(p))

But atoi() behaviour is undefined if argument contains not number, but
letters.

Cite from Open Group POSIX specification: If the value cannot be
represented, the behavior is undefined:
http://www.opengroup.org/onlinepubs/000095399/functions/atoi.html


And I can create device /dev/xvdaa or something like this (I use XCP, so
it is command like: xe vbd-create ... device=999).

And this code become simply 'undefined behaviour. It can crash, do 'rm
-rf /' or simply return wrong value.

---
wBR, George.




_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel