On Tue, Oct 27, 2026 at 12:36:29 +0100, Michal Privoznik wrote:

From: Michal Privoznik <mprivozn@redhat.com>

When parsing <vcpu/> part of domain XML, the number of vCPUs is parsed using virStrToLong_ui() which allows int wrapping (i.e. specifying -1 as a shortcut for UINT_MAX). Well, this is against:

a) our RNG schema, which allows only positive integers, and b) documentation ("(value) ... must be between 1 and the maximum supported by the hypervisor").

Switch to virStrToLong_uip() which rejects negative numbers.

Resolves: https://gitlab.com/libvirt/libvirt/-/work_items/945 Signed-off-by: Michal Privoznik <mprivozn@redhat.com> ---

I think I've seen another incarnation of this bug not so long ago, but couldn't find it. In the end, it doesn't matter.

src/conf/domain_conf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 69c2304f28..51140aa652 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -18410,7 +18410,7 @@ virDomainVcpuParse(virDomainDef *def, if (!(tmp = virXMLNodeContentString(vcpuNode))) return -1;

- if (virStrToLong_ui(tmp, NULL, 10, &maxvcpus) < 0) { + if (virStrToLong_uip(tmp, NULL, 10, &maxvcpus) < 0) { virReportError(VIR_ERR_XML_ERROR, "%s", _("maximum vcpus count must be an integer")); return -1;

Reviewed-by: Jiri Denemark <jdenemar@redhat.com>