On Fri, Nov 09, 2007 at 10:30:15PM +0100, Jim Meyering wrote: > Jim Meyering <jim@xxxxxxxxxxxx> wrote: > > There are over 30 uses of strtol in libvirt, and they all can silently > > accept invalid input. The invalid string might range from an outlandish > > domain ID like 4294967298 to strings of digits followed by bogus alpha. > > Maybe not worth worrying about, you say? But what if they indicate user > > confusion, e.g., 1,000 vs 1000? Silently interpreting "1,000" as "1" > > would leave the poor user even more confused :-) IMHO, they should all > > be diagnosed. > ... > > Patch attached below. > > If you apply it with plain-old-patch, remember to run this: > > > > chmod a+x tests/int-overflow > > > > Thu Nov 8 09:59:43 CET 2007 Jim Meyering <meyering@xxxxxxxxxx> > > > > Diagnose an invalid domain ID number. > > > > * src/virsh.c: Include "xstrtol.h" > > (vshCommandOptDomainBy): Detect integer overflow in domain ID number. > > * tests/int-overflow: New script. Test for the above-fixed bug. > > * tests/Makefile.am (TESTS): Add int-overflow. > > (TESTS_ENVIRONMENT): Define, to propagate $abs_top_* variables > > into the int-overflow script. > > (valgrind): Adapt rule not to clobber new TESTS_ENVIRONMENT. > > * src/xstrtol.h, src/xstrtol.c: New files. > > * src/Makefile.am (virsh_SOURCES): Add xstrtol.c and xstrtol.h. > > Daniel Veillard suggested to put the definition of xstrtol_i in a header > file, so that it can be used both by virsh.c and by the library itself, > so now it's in src/internal.h. I've added a fix for one strtol use in > the library, in xend_internal.c. Finally, I've adjusted the ChangeLog > to more closely match Daniel's preference. Okay applied, thanks ! The choice was either duplicating code or using an inline definition (and associated lack of portability), and since I'm not sure yet anybody compiled libvirt with anything else than gcc (or maybe Solaris cc ?), that's probably better. If needed we can still go back to duplicating code. Daniel -- Red Hat Virtualization group http://redhat.com/virtualization/ Daniel Veillard | virtualization library http://libvirt.org/ veillard@xxxxxxxxxx | libxml GNOME XML XSLT toolkit http://xmlsoft.org/ http://veillard.com/ | Rpmfind RPM search engine http://rpmfind.net/ -- Libvir-list mailing list Libvir-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/libvir-list