|
From: | Max Reitz |
Subject: | Re: [Qemu-devel] [PATCH] qcow2: Fix alloc_clusters_noref() overflow detection |
Date: | Mon, 05 May 2014 17:51:32 +0200 |
User-agent: | Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.5.0 |
On 05.05.2014 11:36, Kevin Wolf wrote:
Am 04.05.2014 um 05:31 hat Max Reitz geschrieben:If the very first allocation has a length of 0, the free_cluster_index is still 0 after the for loop, which means that subtracting one from it will underflow and signal an invalid range of clusters by returning -EFBIG. However, there is no such range, as its length is 0. Fix this by preventing underflows on free_cluster_index during the check. Signed-off-by: Max Reitz <address@hidden>Heh, I wondered about this when I reviewed that other patch, and came to the conclusion that it probably doesn't happen. Did you find a case where it does happen in fact?
Yes, deleting the last internal snapshot results in a 0-byte allocation for the new (empty) snapshot table. If this is the first allocation after an image has been opened (which is the case for qemu-img snapshot -d), you'll receive the “File too big” error message (which confused me quite a bit at first, as I wasn't specifically testing this series).
Max
Anyway, this can't hurt: Reviewed-by: Kevin Wolf <address@hidden>
[Prev in Thread] | Current Thread | [Next in Thread] |