On Tue, Oct 27, 2026 at 12:36:29 +0100, Michal Privoznik wrote: > From: Michal Privoznik <[email protected]> > > When parsing <vcpu/> part of domain XML, the number of vCPUs is > parsed using virStrToLong_ui() which allows int wrapping (i.e. > specifying -1 as a shortcut for UINT_MAX). Well, this is against: > > a) our RNG schema, which allows only positive integers, and > b) documentation ("(value) ... must be between 1 and the maximum > supported by the hypervisor"). > > Switch to virStrToLong_uip() which rejects negative numbers. > > Resolves: https://gitlab.com/libvirt/libvirt/-/work_items/945 > Signed-off-by: Michal Privoznik <[email protected]> > --- > > I think I've seen another incarnation of this bug not so long ago, but > couldn't find it. In the end, it doesn't matter. > > src/conf/domain_conf.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c > index 69c2304f28..51140aa652 100644 > --- a/src/conf/domain_conf.c > +++ b/src/conf/domain_conf.c > @@ -18410,7 +18410,7 @@ virDomainVcpuParse(virDomainDef *def, > if (!(tmp = virXMLNodeContentString(vcpuNode))) > return -1; > > - if (virStrToLong_ui(tmp, NULL, 10, &maxvcpus) < 0) { > + if (virStrToLong_uip(tmp, NULL, 10, &maxvcpus) < 0) { > virReportError(VIR_ERR_XML_ERROR, "%s", > _("maximum vcpus count must be an integer")); > return -1;
Reviewed-by: Jiri Denemark <[email protected]>
