[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-block] [PULL 14/14] qcow2: Read outside array bounds in qcow2_pre_
From: |
Kevin Wolf |
Subject: |
[Qemu-block] [PULL 14/14] qcow2: Read outside array bounds in qcow2_pre_write_overlap_check() |
Date: |
Mon, 12 Nov 2018 18:06:03 +0100 |
From: Liam Merwick <address@hidden>
The commit for 0e4e4318eaa5 increments QCOW2_OL_MAX_BITNR but does not
add an array entry for QCOW2_OL_BITMAP_DIRECTORY_BITNR to metadata_ol_names[].
As a result, an array dereference of metadata_ol_names[8] in
qcow2_pre_write_overlap_check() could result in a read outside of the array
bounds.
Fixes: 0e4e4318eaa5 ('qcow2: add overlap check for bitmap directory')
Cc: Vladimir Sementsov-Ogievskiy <address@hidden>
Signed-off-by: Liam Merwick <address@hidden>
Reviewed-by: Eric Blake <address@hidden>
Reviewed-by: Max Reitz <address@hidden>
Message-id: address@hidden
Signed-off-by: Max Reitz <address@hidden>
---
block/qcow2-refcount.c | 18 ++++++++++--------
1 file changed, 10 insertions(+), 8 deletions(-)
diff --git a/block/qcow2-refcount.c b/block/qcow2-refcount.c
index 3c539f02e5..46082aeac1 100644
--- a/block/qcow2-refcount.c
+++ b/block/qcow2-refcount.c
@@ -2719,15 +2719,17 @@ int qcow2_check_metadata_overlap(BlockDriverState *bs,
int ign, int64_t offset,
}
static const char *metadata_ol_names[] = {
- [QCOW2_OL_MAIN_HEADER_BITNR] = "qcow2_header",
- [QCOW2_OL_ACTIVE_L1_BITNR] = "active L1 table",
- [QCOW2_OL_ACTIVE_L2_BITNR] = "active L2 table",
- [QCOW2_OL_REFCOUNT_TABLE_BITNR] = "refcount table",
- [QCOW2_OL_REFCOUNT_BLOCK_BITNR] = "refcount block",
- [QCOW2_OL_SNAPSHOT_TABLE_BITNR] = "snapshot table",
- [QCOW2_OL_INACTIVE_L1_BITNR] = "inactive L1 table",
- [QCOW2_OL_INACTIVE_L2_BITNR] = "inactive L2 table",
+ [QCOW2_OL_MAIN_HEADER_BITNR] = "qcow2_header",
+ [QCOW2_OL_ACTIVE_L1_BITNR] = "active L1 table",
+ [QCOW2_OL_ACTIVE_L2_BITNR] = "active L2 table",
+ [QCOW2_OL_REFCOUNT_TABLE_BITNR] = "refcount table",
+ [QCOW2_OL_REFCOUNT_BLOCK_BITNR] = "refcount block",
+ [QCOW2_OL_SNAPSHOT_TABLE_BITNR] = "snapshot table",
+ [QCOW2_OL_INACTIVE_L1_BITNR] = "inactive L1 table",
+ [QCOW2_OL_INACTIVE_L2_BITNR] = "inactive L2 table",
+ [QCOW2_OL_BITMAP_DIRECTORY_BITNR] = "bitmap directory",
};
+QEMU_BUILD_BUG_ON(QCOW2_OL_MAX_BITNR != ARRAY_SIZE(metadata_ol_names));
/*
* First performs a check for metadata overlaps (through
--
2.19.1
- [Qemu-block] [PULL 00/14] Block layer patches, Kevin Wolf, 2018/11/12
- [Qemu-block] [PULL 01/14] file-posix: Use error API properly, Kevin Wolf, 2018/11/12
- [Qemu-block] [PULL 03/14] blockdev: Consistently use snapshot_node_name in external_snapshot_prepare(), Kevin Wolf, 2018/11/12
- [Qemu-block] [PULL 04/14] nvme: don't unref ctrl_mem when device unrealized, Kevin Wolf, 2018/11/12
- [Qemu-block] [PULL 02/14] blockdev: handle error on block latency histogram set error, Kevin Wolf, 2018/11/12
- [Qemu-block] [PULL 05/14] nvme: free cmbuf in nvme_exit, Kevin Wolf, 2018/11/12
- [Qemu-block] [PULL 06/14] file-posix: Skip effectiveless OFD lock operations, Kevin Wolf, 2018/11/12
- [Qemu-block] [PULL 10/14] job: Fix off-by-one assert checks for JobSTT and JobVerbTable, Kevin Wolf, 2018/11/12
- [Qemu-block] [PULL 11/14] block: Null pointer dereference in blk_root_get_parent_desc(), Kevin Wolf, 2018/11/12
- [Qemu-block] [PULL 07/14] file-posix: Drop s->lock_fd, Kevin Wolf, 2018/11/12
- [Qemu-block] [PULL 14/14] qcow2: Read outside array bounds in qcow2_pre_write_overlap_check(),
Kevin Wolf <=
- [Qemu-block] [PULL 09/14] block: Make more block drivers compile-time configurable, Kevin Wolf, 2018/11/12
- [Qemu-block] [PULL 13/14] block: Fix potential Null pointer dereferences in vvfat.c, Kevin Wolf, 2018/11/12
- [Qemu-block] [PULL 08/14] tests: Add unit tests for image locking, Kevin Wolf, 2018/11/12
- [Qemu-block] [PULL 12/14] qemu-img: assert block_job_get() does not return NULL in img_commit(), Kevin Wolf, 2018/11/12
- Re: [Qemu-block] [PULL 00/14] Block layer patches, Peter Maydell, 2018/11/13