From: Michal Privoznik <mprivozn@redhat.com> When parsing <vcpu/> part of domain XML, the number of vCPUs is parsed using virStrToLong_ui() which allows int wrapping (i.e. specifying -1 as a shortcut for UINT_MAX). Well, this is against: a) our RNG schema, which allows only positive integers, and b) documentation ("(value) ... must be between 1 and the maximum supported by the hypervisor"). Switch to virStrToLong_uip() which rejects negative numbers. Resolves: https://gitlab.com/libvirt/libvirt/-/work_items/945 Signed-off-by: Michal Privoznik <mprivozn@redhat.com> --- I think I've seen another incarnation of this bug not so long ago, but couldn't find it. In the end, it doesn't matter. src/conf/domain_conf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 69c2304f28..51140aa652 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -18410,7 +18410,7 @@ virDomainVcpuParse(virDomainDef *def, if (!(tmp = virXMLNodeContentString(vcpuNode))) return -1; - if (virStrToLong_ui(tmp, NULL, 10, &maxvcpus) < 0) { + if (virStrToLong_uip(tmp, NULL, 10, &maxvcpus) < 0) { virReportError(VIR_ERR_XML_ERROR, "%s", _("maximum vcpus count must be an integer")); return -1; -- 2.56.0