Hi,
Please find the latest report on new defect(s) introduced to libvirt found with Coverity Scan.
** CID 915441: Integer handling issues (CONSTANT_EXPRESSION_RESULT)
/src/esx/esx_driver.c: 2091 in esxDomainGetInfo()
_____________________________________________________________________________________________
*** CID 915441: Integer handling issues (CONSTANT_EXPRESSION_RESULT)
/src/esx/esx_driver.c: 2091 in esxDomainGetInfo()
2085 } else if (STREQ(dynamicProperty->name, "config.hardware.memoryMB")) {
2086 if (esxVI_AnyType_ExpectType(dynamicProperty->val,
2087 esxVI_Type_Int) < 0) {
2088 goto cleanup;
2089 }
2090
>>> CID 915441: Integer handling issues (CONSTANT_EXPRESSION_RESULT)
>>> "18446744073709551615UL /* 9223372036854775807L * 2UL + 1UL - 0 */ < (*dynamicProperty->val).int32 * 1024" is always false regardless of the values of its operands. This occurs as the logical second operand of "||".
2091 if (VIR_MULTIPLY_ADD_IS_OVERFLOW(ULONG_MAX,
2092 dynamicProperty->val->int32, 1024, 0)) {
2093 virReportError(VIR_ERR_OVERFLOW,
2094 _("the maximum memory value too large: %1$llu"),
2095 (unsigned long long) dynamicProperty->val->int32);
2096 goto cleanup;
** CID 915440: Integer handling issues (CONSTANT_EXPRESSION_RESULT)
/src/esx/esx_driver.c: 2118 in esxDomainGetInfo()
_____________________________________________________________________________________________
*** CID 915440: Integer handling issues (CONSTANT_EXPRESSION_RESULT)
/src/esx/esx_driver.c: 2118 in esxDomainGetInfo()
2112 goto cleanup;
2113 }
2114
2115 memory_limit = dynamicProperty->val->int64;
2116
2117 if (memory_limit > 0) {
>>> CID 915440: Integer handling issues (CONSTANT_EXPRESSION_RESULT)
>>> "18446744073709551615UL /* 9223372036854775807L * 2UL + 1UL - 0 */ < memory_limit * 1024" is always false regardless of the values of its operands. This occurs as the logical second operand of "||".
2118 if (VIR_MULTIPLY_ADD_IS_OVERFLOW(ULONG_MAX, memory_limit, 1024, 0)) {
2119 virReportError(VIR_ERR_OVERFLOW,
2120 _("the current memory value too large: %1$llu"),
2121 (unsigned long long) memory_limit);
2122 goto cleanup;
2123 }
** CID 915439: (CONSTANT_EXPRESSION_RESULT)
/tests/utiltest.c: 431 in testMultiplyAddIsOverflow()
/tests/utiltest.c: 443 in testMultiplyAddIsOverflow()
/tests/utiltest.c: 455 in testMultiplyAddIsOverflow()
_____________________________________________________________________________________________
*** CID 915439: (CONSTANT_EXPRESSION_RESULT)
/tests/utiltest.c: 431 in testMultiplyAddIsOverflow()
425
426 static int
427 testMultiplyAddIsOverflow(const void *data G_GNUC_UNUSED)
428 {
429 unsigned long a = ULONG_MAX / 1024UL;
430
>>> CID 915439: (CONSTANT_EXPRESSION_RESULT)
>>> "18446744073709550592UL /* 9223372036854775807L * 2UL + 1UL - 1023 */ < a * 1024" is always false regardless of the values of its operands. This occurs as the logical second operand of "||".
431 if (VIR_MULTIPLY_ADD_IS_OVERFLOW(ULONG_MAX, a, 1024, 1023)) {
432 VIR_TEST_DEBUG("should not have failed (limit=%lu, value%lu, multiply=1024, add=1023).",
433 ULONG_MAX, a);
434 return -1;
435 }
436
/tests/utiltest.c: 443 in testMultiplyAddIsOverflow()
437 if (!VIR_MULTIPLY_ADD_IS_OVERFLOW(ULONG_MAX, a, 1024, 1024)) {
438 VIR_TEST_DEBUG("should have failed (limit=%lu, value=%lu, multiply=1024, add=1024).",
439 ULONG_MAX, a);
440 return -1;
441 }
442
>>> CID 915439: (CONSTANT_EXPRESSION_RESULT)
>>> "18446744073709550592UL /* 9223372036854775807L * 2UL + 1UL - 1022 - 1 */ < a * 1024" is always false regardless of the values of its operands. This occurs as the logical second operand of "||".
443 if (VIR_MULTIPLY_ADD_IS_OVERFLOW(ULONG_MAX - 1022, a, 1024, 1)) {
444 VIR_TEST_DEBUG("should not have failed (limit=%lu, value=%lu, multiply=1024, add=1).",
445 ULONG_MAX - 1022, a);
446 return -1;
447 }
448
/tests/utiltest.c: 455 in testMultiplyAddIsOverflow()
449 if (!VIR_MULTIPLY_ADD_IS_OVERFLOW(ULONG_MAX - 1023, a, 1024, 1)) {
450 VIR_TEST_DEBUG("should have failed (limit=%lu, value=%lu, multiply=1024, add=1).",
451 ULONG_MAX - 1023, a);
452 return -1;
453 }
454
>>> CID 915439: (CONSTANT_EXPRESSION_RESULT)
>>> "18446744073709551615UL /* 9223372036854775807L * 2UL + 1UL - 0 */ < a * 1024" is always false regardless of the values of its operands. This occurs as the logical second operand of "||".
455 if (VIR_MULTIPLY_ADD_IS_OVERFLOW(ULONG_MAX, a, 1024, 0)) {
456 VIR_TEST_DEBUG("should not have failed (limit=%lu, value=%lu, multiply=1024, add=0).",
457 ULONG_MAX, a);
458 return -1;
459 }
460
Best regards,
The Coverity Scan Admin Team
