[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 10/18] qcow2: fix offset overflow in qcow2_alloc_clus
From: |
Kevin Wolf |
Subject: |
[Qemu-devel] [PULL 10/18] qcow2: fix offset overflow in qcow2_alloc_clusters_at() |
Date: |
Sun, 9 Feb 2014 09:46:22 +0100 |
From: Hu Tao <address@hidden>
When cluster size is big enough it can lead to an offset overflow
in qcow2_alloc_clusters_at(). This patch fixes it.
The allocation is stopped each time at L2 table boundary
(see handle_alloc()), so the possible maximum bytes could be
2^(cluster_bits - 3 + cluster_bits)
cluster_bits - 3 is used to compute the number of entry by L2
and the additional cluster_bits is to take into account each
clusters referenced by the L2 entries.
so int is safe for cluster_bits<=17, unsafe otherwise.
Signed-off-by: Hu Tao <address@hidden>
Reviewed-by: Max Reitz <address@hidden>
Reviewed-by: Benoit Canet <address@hidden>
Signed-off-by: Kevin Wolf <address@hidden>
---
block/qcow2-refcount.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/block/qcow2-refcount.c b/block/qcow2-refcount.c
index c974abe..8712d8b 100644
--- a/block/qcow2-refcount.c
+++ b/block/qcow2-refcount.c
@@ -676,7 +676,13 @@ int qcow2_alloc_clusters_at(BlockDriverState *bs, uint64_t
offset,
BDRVQcowState *s = bs->opaque;
uint64_t cluster_index;
uint64_t old_free_cluster_index;
- int i, refcount, ret;
+ uint64_t i;
+ int refcount, ret;
+
+ assert(nb_clusters >= 0);
+ if (nb_clusters == 0) {
+ return 0;
+ }
/* Check how many clusters there are free */
cluster_index = offset >> s->cluster_bits;
--
1.8.1.4
- [Qemu-devel] [PULL 00/18] Block patches, Kevin Wolf, 2014/02/09
- [Qemu-devel] [PULL 02/18] block: add native support for NFS, Kevin Wolf, 2014/02/09
- [Qemu-devel] [PULL 01/18] qemu-iotest: Make 077 raw-only, Kevin Wolf, 2014/02/09
- [Qemu-devel] [PULL 03/18] qemu-iotests: change _supported_proto to file for various tests, Kevin Wolf, 2014/02/09
- [Qemu-devel] [PULL 04/18] qemu-iotests: blacklist test 020 for NFS protocol, Kevin Wolf, 2014/02/09
- [Qemu-devel] [PULL 05/18] qemu-iotests: enable test 016 and 025 to work with NFS protocol, Kevin Wolf, 2014/02/09
- [Qemu-devel] [PULL 06/18] qemu-iotests: enable support for NFS protocol, Kevin Wolf, 2014/02/09
- [Qemu-devel] [PULL 08/18] block/iscsi: always fill bs->bl.opt_transfer_length, Kevin Wolf, 2014/02/09
- [Qemu-devel] [PULL 09/18] qcow2: remove n_start and n_end of qcow2_alloc_cluster_offset(), Kevin Wolf, 2014/02/09
- [Qemu-devel] [PULL 07/18] block: Fail gracefully with missing filename, Kevin Wolf, 2014/02/09
- [Qemu-devel] [PULL 10/18] qcow2: fix offset overflow in qcow2_alloc_clusters_at(),
Kevin Wolf <=
- [Qemu-devel] [PULL 11/18] qcow2: check for NULL l2meta, Kevin Wolf, 2014/02/09
- [Qemu-devel] [PULL 12/18] qemu-iotests: add test for qcow2 preallocation with different cluster sizes, Kevin Wolf, 2014/02/09
- [Qemu-devel] [PULL 13/18] raw: Fix BlockLimits passthrough, Kevin Wolf, 2014/02/09
- [Qemu-devel] [PULL 14/18] block: Fix memory leaks in bdrv_co_do_pwritev(), Kevin Wolf, 2014/02/09
- [Qemu-devel] [PULL 15/18] block: bdrv_aligned_pwritev: Assert overlap range, Kevin Wolf, 2014/02/09
- [Qemu-devel] [PULL 16/18] block: Don't call ROUND_UP with negative values, Kevin Wolf, 2014/02/09
- [Qemu-devel] [PULL 17/18] blkdebug: Don't leak bs->file on failure, Kevin Wolf, 2014/02/09
- [Qemu-devel] [PULL 18/18] block: Fix 32 bit truncation in mark_request_serialising(), Kevin Wolf, 2014/02/09
- Re: [Qemu-devel] [PULL 00/18] Block patches, Peter Maydell, 2014/02/12