diff options
| author | Markus Armbruster <armbru@redhat.com> | 2020-04-24 10:43:32 +0200 |
|---|---|---|
| committer | Markus Armbruster <armbru@redhat.com> | 2020-04-30 07:26:40 +0200 |
| commit | faad584adb48737aa3b39984786442a1a9c42aa4 (patch) | |
| tree | bca7441b7316d514e07f73add2d3e00011edca85 | |
| parent | 777d20cfa5735de298f378e9b90f0cd1caafdc2d (diff) | |
qapi: Assert non-input visitors see only valid narrow integers
visit_type_intN() and visit_type_uintN() fail when the value is out of
bounds.
This is appropriate with an input visitor: the value comes from input,
and input may be bad.
It should never happen with the other visitors: the value comes from
the caller, and callers must keep it within bounds. Assert that.
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-Id: <20200424084338.26803-10-armbru@redhat.com>
| -rw-r--r-- | qapi/qapi-visit-core.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/qapi/qapi-visit-core.c b/qapi/qapi-visit-core.c index 80ca83bcb9..74aa9c04bd 100644 --- a/qapi/qapi-visit-core.c +++ b/qapi/qapi-visit-core.c @@ -160,10 +160,13 @@ static void visit_type_uintN(Visitor *v, uint64_t *obj, const char *name, Error *err = NULL; uint64_t value = *obj; + assert(v->type == VISITOR_INPUT || value <= max); + v->type_uint64(v, name, &value, &err); if (err) { error_propagate(errp, err); } else if (value > max) { + assert(v->type == VISITOR_INPUT); error_setg(errp, QERR_INVALID_PARAMETER_VALUE, name ? name : "null", type); } else { @@ -219,10 +222,13 @@ static void visit_type_intN(Visitor *v, int64_t *obj, const char *name, Error *err = NULL; int64_t value = *obj; + assert(v->type == VISITOR_INPUT || (value >= min && value <= max)); + v->type_int64(v, name, &value, &err); if (err) { error_propagate(errp, err); } else if (value < min || value > max) { + assert(v->type == VISITOR_INPUT); error_setg(errp, QERR_INVALID_PARAMETER_VALUE, name ? name : "null", type); } else { |