Hi,

> parse_uint_full takes an 'unsigned long long *', but you are passing an
> 'int *'.  I'm surprised it compiled for you.  It causes a buffer
> overflow if the pointer is assigned to, and gives different results
> depending on platform endianness.

Fixed in v4.

> > +            error_setg(errp, "can't convert to a number: %s", port);
> > +            return -1;
> > +        }
> > +        if (baseport < 0 || baseport + port_offset > 65535) {
> > +            error_setg(errp, "port %s out of range", port);
> 
> But errno is not set to a sane value at this point, so error_setg() is
> wrong.

That would be true for error_setg_errno()-

cheers,
  Gerd





Reply via email to