qemu-devel
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Qemu-devel] [PATCH v2 11/12] qcow2/overlaps: Protect inactive L2 ta


From: Stefan Hajnoczi
Subject: Re: [Qemu-devel] [PATCH v2 11/12] qcow2/overlaps: Protect inactive L2 tables
Date: Wed, 21 Jan 2015 15:23:53 +0000
User-agent: Mutt/1.5.23 (2014-03-12)

On Mon, Nov 24, 2014 at 04:56:59PM +0100, Max Reitz wrote:
> @@ -136,6 +138,34 @@ int qcow2_read_snapshots(BlockDriverState *bs)
>                                    size_to_clusters(s, sn->l1_size *
>                                                        sizeof(uint64_t)),
>                                    QCOW2_OL_INACTIVE_L1);
> +
> +        if (!(s->overlap_check & QCOW2_OL_INACTIVE_L2)) {
> +            continue;
> +        }
> +
> +        l1_table = qemu_try_blockalign(bs->file,
> +                                       sn->l1_size * sizeof(uint64_t));

At this point we haven't validated sn->l1_size <= QCOW_MAX_L1_SIZE.

A bogus l1_size means we do a huge read and add junk into the metadata
list.  I think it would be best to check the value here.

Attachment: pgpcUiL9j2KZL.pgp
Description: PGP signature


reply via email to

[Prev in Thread] Current Thread [Next in Thread]