Re: [Xen-devel] [PATCH v3] libxl_set_memory_target: retain the same maxmem offset on top of the current target

[Ian Campbell <Ian.Campbell@xxxxxxxxxx>]

On Thu, 2015-01-29 at 15:08 +0000, Stefano Stabellini wrote:
> @@ -4775,6 +4781,14 @@ retry_transaction:
>              new_target_memkb = current_target_memkb + target_memkb;
>      } else
>          new_target_memkb = target_memkb - videoram;
> +
> +    if (new_target_memkb <= 0) {
> +        LIBXL__LOG(ctx, LIBXL__LOG_ERROR,
> +                "cannot set memory target to 0 or less than 0.\n");


new_target_memkb is uint32 so it can't be less than zero.

In fact, there looks to be some under/overflow bugs hidden in this
function. e.g. in "new_target_memkb = target_memkb" (since target is
signed)

Ian.


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel