ia64/xen-unstable

changeset 16132:c19c51317eeb

libxc: Avoid overflow in xc_domain_dumpcore_via_callback().
nr_pages*PAGE_SIZE can overflow a 32-bit long.
From: Daisuke Nishimura <nishimura@mxp.nes.nec.co.jp>
Signed-off-by: Keir Fraser <keir@xensource.com>
author Keir Fraser <keir@xensource.com>
date Mon Oct 15 12:20:43 2007 +0100 (2007-10-15)
parents c918a68617c9
children 2372f89c0447
files tools/libxc/xc_core.c
line diff
     1.1 --- a/tools/libxc/xc_core.c	Mon Oct 15 12:13:41 2007 +0100
     1.2 +++ b/tools/libxc/xc_core.c	Mon Oct 15 12:20:43 2007 +0100
     1.3 @@ -628,7 +628,7 @@ xc_domain_dumpcore_via_callback(int xc_h
     1.4          PERROR("could not get section headers for .xen_pages");
     1.5          goto out;
     1.6      }
     1.7 -    filesz = nr_pages * PAGE_SIZE;
     1.8 +    filesz = (uint64_t)nr_pages * PAGE_SIZE;
     1.9      sts = xc_core_shdr_set(shdr, strtab, XEN_DUMPCORE_SEC_PAGES, SHT_PROGBITS,
    1.10                             offset, filesz, PAGE_SIZE, PAGE_SIZE);
    1.11      if ( sts != 0 )
    1.12 @@ -644,7 +644,7 @@ xc_domain_dumpcore_via_callback(int xc_h
    1.13      }
    1.14      if ( !auto_translated_physmap )
    1.15      {
    1.16 -        filesz = nr_pages * sizeof(p2m_array[0]);
    1.17 +        filesz = (uint64_t)nr_pages * sizeof(p2m_array[0]);
    1.18          sts = xc_core_shdr_set(shdr, strtab, XEN_DUMPCORE_SEC_P2M,
    1.19                                 SHT_PROGBITS,
    1.20                                 offset, filesz, __alignof__(p2m_array[0]),
    1.21 @@ -652,7 +652,7 @@ xc_domain_dumpcore_via_callback(int xc_h
    1.22      }
    1.23      else
    1.24      {
    1.25 -        filesz = nr_pages * sizeof(pfn_array[0]);
    1.26 +        filesz = (uint64_t)nr_pages * sizeof(pfn_array[0]);
    1.27          sts = xc_core_shdr_set(shdr, strtab, XEN_DUMPCORE_SEC_PFN,
    1.28                                 SHT_PROGBITS,
    1.29                                 offset, filesz, __alignof__(pfn_array[0]),