[Qemu-devel] [PATCH 1/2] hmp: expr_unary(): check for overflow in strtoul()

[Luiz Capitulino]

It's not checked currently, so something like:

  (qemu) balloon -100000000000001111114334234
  (qemu)

Will just "work" (in this case the balloon command will get a random
value).

Fix it by checking if strtout() overflowed.

Signed-off-by: Luiz Capitulino <address@hidden>
---
 monitor.c |    6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/monitor.c b/monitor.c
index 8946a10..6178f48 100644
--- a/monitor.c
+++ b/monitor.c
@@ -3122,8 +3122,14 @@ static int64_t expr_unary(Monitor *mon)
     default:
 #if TARGET_PHYS_ADDR_BITS > 32
         n = strtoull(pch, &p, 0);
+        if (n == ULLONG_MAX && errno == ERANGE) {
+            expr_error(mon, "error: too long number");
+        }
 #else
         n = strtoul(pch, &p, 0);
+        if (n == ULONG_MAX && errno == ERANGE) {
+            expr_error(mon, "error: too long number");
+        }
 #endif
         if (pch == p) {
             expr_error(mon, "invalid char in expression");
-- 
1.7.9.2.384.g4a92a