[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [PATCH v4 03/16] block: fix theoretical overflow in bdrv_init_paddin
From: |
Eric Blake |
Subject: |
Re: [PATCH v4 03/16] block: fix theoretical overflow in bdrv_init_padding() |
Date: |
Thu, 21 Jan 2021 16:42:30 -0600 |
User-agent: |
Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Thunderbird/78.6.0 |
On 12/11/20 12:39 PM, Vladimir Sementsov-Ogievskiy wrote:
> Calculation of sum may theoretically overflow, so use 64bit type and
> add some good assertions.
>
> Use int64_t constantly.
>
> Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
> ---
> block/io.c | 8 ++++++--
> 1 file changed, 6 insertions(+), 2 deletions(-)
>
> diff --git a/block/io.c b/block/io.c
> index 21e8a50725..d9bc67f1b0 100644
> --- a/block/io.c
> +++ b/block/io.c
> @@ -1537,8 +1537,12 @@ static bool bdrv_init_padding(BlockDriverState *bs,
> int64_t offset, int64_t bytes,
> BdrvRequestPadding *pad)
> {
> - uint64_t align = bs->bl.request_alignment;
> - size_t sum;
> + int64_t align = bs->bl.request_alignment;
> + int64_t sum;
> +
> + bdrv_check_request(offset, bytes, &error_abort);
> + assert(align <= INT_MAX); /* documented in block/block_int.h */
> + assert(align * 2 <= SIZE_MAX); /* so we can allocate the buffer */
Would look better as assert(align <= SIZE_MAX / 2); but not technically
wrong as written because the earlier line proved align is less than 32
bits so align*2 can't overflow 63 bits.
Reviewed-by: Eric Blake <eblake@redhat.com>
--
Eric Blake, Principal Software Engineer
Red Hat, Inc. +1-919-301-3226
Virtualization: qemu.org | libvirt.org
[Prev in Thread] |
Current Thread |
[Next in Thread] |
- Re: [PATCH v4 03/16] block: fix theoretical overflow in bdrv_init_padding(),
Eric Blake <=