Re: [Xen-devel] possible bug on libxc ? on amd64

[Daniel Stodden <stodden@xxxxxxxxxx>]

On Sat, 2007-12-01 at 16:25 +0100, Enrico Maniciati wrote:

> In function  :

> xc_core_shdr_get(struct xc_core_section_headers *sheaders) {

>     if ( sheaders->num == sheaders->num_max )
>     {
>         Elf64_Shdr *shdrs;
>         if ( sheaders->num_max + SHDR_INC < sheaders->num_max )  <---
> in this point 

sorry, good point, but this is a test against integer wrap.

>        {
>             errno = E2BIG;
>             return NULL;
>         }
>         sheaders->num_max += SHDR_INC;

num max is a 16bit integer, SHDR_INC is def'd to 4.
the function allocates up to 65532 entries, then num_max wraps to zero
and it reports failure. it's probably okay like this.

>         shdrs = realloc(sheaders->shdrs,
>                         sizeof(sheaders->shdrs[0]) *
> sheaders->num_max);

>         if ( shdrs == NULL ) <<-- word wrap ??

no, this means out of memory.

> i think this are correct: 

[...]

quite frankly, with the exception of variants in bracing and indentation
i don't see the difference.

> Always happy c++

> C++ are always better than other J 

thanks for all the hints. 

a tip in return: check out the 'diff' command (supposed you've got
cygwin or similar installed). works approximately like this:

        $ cp xc_core.c xc_core.c.orig
        /* .. edit xc_core.c */
        $ diff xc_core.c.orig xc_core.c > xc_core.c.diff

the resulting .diff-file is what best suited to send to mailing lists in
order to suggest buf fixes or improvement to source code.

thanks and regards,
daniel


-- 
Daniel Stodden
LRR     -      Lehrstuhl für Rechnertechnik und Rechnerorganisation
Institut für Informatik der TU München             D-85748 Garching
http://www.lrr.in.tum.de/~stodden         mailto:stodden@xxxxxxxxxx
PGP Fingerprint: F5A4 1575 4C56 E26A 0B33  3D80 457E 82AE B0D8 735B



_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel