qemu: Check the unsigned integer overflow

As perhaps other hypervisor drivers use different capacity units,
do the checking in qemu driver instead of in conf/domain_conf.c.

diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
index 72f55d001c56cf5c252d995108885c2b1404e15f..c63de0914bbc8b14865c6f08b24dea1fc27f3626 100644 (file)
--- a/src/qemu/qemu_command.c
+++ b/src/qemu/qemu_command.c
@@ -1934,6 +1934,13 @@ qemuBuildVideoDevStr(virDomainVideoDefPtr video,
     virBufferVSprintf(&buf, ",id=%s", video->info.alias);
 
     if (video->type == VIR_DOMAIN_VIDEO_TYPE_QXL) {
+        if (video->vram > (UINT_MAX / 1024)) {
+            qemuReportError(VIR_ERR_INVALID_ARG,
+                            _("value for 'vram' must be less than '%u'"),
+                            UINT_MAX / 1024);
+            goto error;
+        }
+
         /* QEMU accepts bytes for vram_size. */
         virBufferVSprintf(&buf, ",vram_size=%u", video->vram * 1024);
     }
@@ -4042,7 +4049,15 @@ qemuBuildCommandLine(virConnectPtr conn,
                 if (def->videos[0]->type == VIR_DOMAIN_VIDEO_TYPE_QXL) {
                     if (def->videos[0]->vram &&
                         qemuCapsGet(qemuCaps, QEMU_CAPS_DEVICE)) {
+                        if (def->videos[0]->vram > (UINT_MAX / 1024)) {
+                            qemuReportError(VIR_ERR_INVALID_ARG,
+                                            _("value for 'vram' must be less than '%u'"),
+                                            UINT_MAX / 1024);
+                            goto error;
+                        }
+
                         virCommandAddArg(cmd, "-global");
+
                         if (qemuCapsGet(qemuCaps, QEMU_CAPS_DEVICE_QXL_VGA))
                             virCommandAddArgFormat(cmd, "qxl-vga.vram_size=%u",
                                                    def->videos[0]->vram * 1024);