Bin Guo <[email protected]> writes: > The HMP expression evaluator performed *, +, - and unary - on int64_t > values without checking for overflow. A malformed expression such as > "0x7fffffffffffffff + 1" would silently wrap around to INT64_MIN and > could then be passed as a physical address to the "xp" command.
Isn't that a feature? It wraps to (int64_t)0x8000000000000000, is put in the argument QDict, passed to hmp_physical_memory_dump(), which implicitly converts to uint64_t, then passes to memory_dump(). Such cavalier signedness conversions are endemic in old C code like this. The same conversions happen when you write the expression as "0x8000000000000000" instead. [...]
