[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH v2 2/3] qcow2: fix offset overflow in qcow2_alloc_cl
From: |
Hu Tao |
Subject: |
[Qemu-devel] [PATCH v2 2/3] qcow2: fix offset overflow in qcow2_alloc_clusters_at() |
Date: |
Mon, 20 Jan 2014 11:46:54 +0800 |
When cluster size is big enough it can lead offset overflow
in qcow2_alloc_clusters_at(). This patch fixes it.
The allocation each time is stopped at L2 table boundary
(see handle_alloc()), so the possible maximum bytes could be
2^(cluster_bits - 3 + cluster_bits)
so int is safe for cluster_bits<=17, unsafe otherwise.
Signed-off-by: Hu Tao <address@hidden>
---
block/qcow2-refcount.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/block/qcow2-refcount.c b/block/qcow2-refcount.c
index c974abe..6c13369 100644
--- a/block/qcow2-refcount.c
+++ b/block/qcow2-refcount.c
@@ -676,7 +676,12 @@ int qcow2_alloc_clusters_at(BlockDriverState *bs, uint64_t
offset,
BDRVQcowState *s = bs->opaque;
uint64_t cluster_index;
uint64_t old_free_cluster_index;
- int i, refcount, ret;
+ uint64_t i;
+ int refcount, ret;
+
+ if (nb_clusters <= 0) {
+ return -EINVAL;
+ }
/* Check how many clusters there are free */
cluster_index = offset >> s->cluster_bits;
--
1.8.5.2.229.g4448466