From 22644cd2c60151a964d9505f4c5f7baf845f20d8 Mon Sep 17 00:00:00 2001 From: Markus Armbruster Date: Wed, 1 Oct 2014 18:43:44 +0200 Subject: [PATCH] virtio-balloon: Tweak recent fix for integer overflow Commit 1f9296b avoids "other kinds of overflow" by limiting the polling interval to UINT_MAX. The computations to protect are done in 64 bits. This is indeed safe when unsigned is 32 bits, as it commonly is. It isn't when unsigned is 64 bits. Purely theoretical; I'm not aware of such a system. Limit it to UINT32_MAX instead. Signed-off-by: Markus Armbruster Reviewed-by: Eric Blake Signed-off-by: Luiz Capitulino --- hw/virtio/virtio-balloon.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c index b5cf7cacc0..7bfbb75ad3 100644 --- a/hw/virtio/virtio-balloon.c +++ b/hw/virtio/virtio-balloon.c @@ -170,7 +170,7 @@ static void balloon_stats_set_poll_interval(Object *obj, struct Visitor *v, return; } - if (value > UINT_MAX) { + if (value > UINT32_MAX) { error_setg(errp, "timer value is too big"); return; }