• D
    Fix subtle integer overflow bug in memory API · d2963631
    David Gibson 提交于
    It is quite common to have a MemoryRegion with size of INT64_MAX.
    When processing alias regions in render_memory_region() it's quite
    easy to find a case where it will construct a temporary AddrRange with
    a non-zero start, and size still of INT64_MAX.  When means attempting
    to compute the end of such a range as start + size will result in
    signed integer overflow.
    
    This integer overflow means that addrrange_intersects() can
    incorrectly report regions as not intersecting when they do.  For
    example consider the case of address ranges {0x10000000000,
    0x7fffffffffffffff} and {0x10010000000, 0x10000000} where the second
    is in fact included completely in the first.
    
    This patch rearranges addrrange_intersects() to avoid the integer
    overflow, correcting this behaviour.
    Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
    Signed-off-by: NAvi Kivity <avi@redhat.com>
    d2963631
memory.c 36.5 KB