From nobody Sun Oct 25 16:51:03 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) client-ip=38.145.34.151; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass(p=reject dis=none) header.from=lists.libvirt.org ARC-Seal: i=1; a=rsa-sha256; t=1792762201; cv=none; d=zohomail.com; s=zohoarc; b=C3Wb83V3PUCfGDMePfJh60Fz+SBnm72dZdkl2v0LWr9wlrzA6IX0aLeGTtYr+IKUfqmv8TOY6dp7GTKori4Oryu9WjVp4nSeLJZZWqIua1J3+sjFPJ4cvwcuTlJ9UOUGfL+v/TCKMEZpx46boiSf/7w8AZMC3HtH+yZJi432J90= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792762201; h=Content-Type:Content-Transfer-Encoding:Date:Date:From:From:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:Reply-To:Subject:Subject:To:To:Message-Id:Cc; bh=XBmI2NwKaC164dahU1Iua+6kpvK47u6kL9R/KGmQaRk=; b=iDNOUM+xIoqD9kvwhLs4mGqAHl7h5///e24qxuLggVHkH9BFXiw8glrM5/OPosHibg7OVzF37DSk5XP6Jl6tkQoA1VPWH7tU/utAKCRn3AcN2OS9aPvsmckbcJgEdP0x/uRrsFQQMdh0RRtLuk0KBZJrDG1YZ47YuqE2On2AV6U= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [38.145.34.151]) by mx.zohomail.com with SMTPS id 1792762201196542.0976264824019; Fri, 23 Oct 2026 06:30:01 -0700 (PDT) Received: by lists.libvirt.org (Postfix, from userid 993) id 692573F321; Fri, 23 Oct 2026 09:29:59 -0400 (EDT) Received: from [172.19.199.19] (unknown [10.16.107.18]) by lists.libvirt.org (Postfix) with ESMTP id BEAF241B9F; Fri, 23 Oct 2026 09:29:05 -0400 (EDT) Received: by lists.libvirt.org (Postfix, from userid 993) id 1C0763F321; Fri, 23 Oct 2026 09:28:58 -0400 (EDT) Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id 8A06F3F308 for ; Fri, 23 Oct 2026 09:28:56 -0400 (EDT) Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-587-XmB1kP33NdGzK0eUAEG1XQ-1; Fri, 23 Oct 2026 09:28:54 -0400 Received: from mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id DD4D318088B8 for ; Fri, 23 Oct 2026 13:28:53 +0000 (UTC) Received: from mprivozn-thinkpadt14gen4.tpbc.csb (unknown [10.43.3.180]) by mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 4C34C1955F01 for ; Fri, 23 Oct 2026 13:28:53 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-3.4 required=5.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,MAILING_LIST_MULTI,RCVD_IN_DNSWL_LOW,SPF_HELO_PASS autolearn=unavailable autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1792762136; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=XBmI2NwKaC164dahU1Iua+6kpvK47u6kL9R/KGmQaRk=; b=ZfwspQITK92N7+yIX5g4zTS8+pSttvaemBG/UEv7dpTLhCAb6YlnXRsqOGkoeST/9hYexG LtOe1R6mtmsDCLq5FX4nv8Pg3UuLEO6CCUlhni9CpmrSewYOfTH7C/hH9guIU/Wb9C9J94 COB9Dfrr0AZdWAMA63LFW4NnooaLuPI= X-MC-Unique: XmB1kP33NdGzK0eUAEG1XQ-1 X-Mimecast-MFC-AGG-ID: XmB1kP33NdGzK0eUAEG1XQ_1792762134 To: devel@lists.libvirt.org Subject: [PATCH] esx: Avoid integer overflow in esxDomainGetInfo() Date: Fri, 23 Oct 2026 15:28:51 +0200 Message-ID: <117711ef14d77897c26d79600bc5f5fb95aceaf9.1792762131.git.mprivozn@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.0 on 10.30.177.12 X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: neXN_WxPiU42CJCvnx0T09HzzdgI_-LkEqfcdgcmGC0_1792762134 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: quoted-printable Message-ID-Hash: BW3F2ZYLF5CTNO2JFYAVQEGTS5SQ3LMR X-Message-ID-Hash: BW3F2ZYLF5CTNO2JFYAVQEGTS5SQ3LMR X-MailFrom: mprivozn@redhat.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: From: Michal Privoznik via Devel Reply-To: Michal Privoznik X-ZohoMail-DKIM: fail (Header signature does not verify) X-ZM-MESSAGEID: 1792762202926158500 Content-Type: text/plain; charset="utf-8"; x-default="true" From: Michal Privoznik The virDomainGetInfo() fills virDomainInfo structure for given domain. The struct contains memory and maxMem members (among others) to store current and maximum memory for the domain. Both members are of 'unsigned long' type. Now, inside the ESX driver's implementation (esxDomainGetInfo()) these values are stored in a variables of int64_t and int32_t, respectively. But since both values, as reported by hypervisor are in MiB, they are multiplied by 1024 because we report memory sizes in KiB. Well, for very large guests, and 32bit hosts, unsigned long might not be large enough to hold the value. Check for overflow and also in case of 'maxMem' (which is multiplied directly) specify the type of '1024' constant to ensure proper typecast before multiplication. Resolves: https://gitlab.com/libvirt/libvirt/-/work_items/937 Signed-off-by: Michal Privoznik --- src/esx/esx_driver.c | 21 +++++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-) diff --git a/src/esx/esx_driver.c b/src/esx/esx_driver.c index 75bbd07750..daca30aeca 100644 --- a/src/esx/esx_driver.c +++ b/src/esx/esx_driver.c @@ -2088,7 +2088,16 @@ esxDomainGetInfo(virDomainPtr domain, virDomainInfoP= tr info) goto cleanup; } =20 - info->maxMem =3D dynamicProperty->val->int32 * 1024; /* Scale = from megabyte to kilobyte */ + if (VIR_MULTIPLY_ADD_IS_OVERFLOW(ULONG_MAX, + dynamicProperty->val->int32, = 1024, 0)) { + virReportError(VIR_ERR_OVERFLOW, + _("the maximum memory value too large: %1$l= lu"), + (unsigned long long) dynamicProperty->val->= int32); + goto cleanup; + } + + /* Scale from megabyte to kilobyte */ + info->maxMem =3D dynamicProperty->val->int32 * 1024UL; } else if (STREQ(dynamicProperty->name, "config.hardware.numCPU"))= { if (esxVI_AnyType_ExpectType(dynamicProperty->val, esxVI_Type_Int) < 0) { @@ -2105,8 +2114,16 @@ esxDomainGetInfo(virDomainPtr domain, virDomainInfoP= tr info) =20 memory_limit =3D dynamicProperty->val->int64; =20 - if (memory_limit > 0) + if (memory_limit > 0) { + if (VIR_MULTIPLY_ADD_IS_OVERFLOW(ULONG_MAX, memory_limit, = 1024, 0)) { + virReportError(VIR_ERR_OVERFLOW, + _("the current memory value too large: = %1$llu"), + (unsigned long long) memory_limit); + goto cleanup; + } + memory_limit *=3D 1024; /* Scale from megabyte to kilobyte= */ + } } else { VIR_WARN("Unexpected '%s' property", dynamicProperty->name); } --=20 2.56.0