[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH v5 2/4] qcow2: fix offset overflow in qcow2_allo
From: |
Benoît Canet |
Subject: |
Re: [Qemu-devel] [PATCH v5 2/4] qcow2: fix offset overflow in qcow2_alloc_clusters_at() |
Date: |
Sun, 26 Jan 2014 05:15:42 +0100 |
User-agent: |
Mutt/1.5.21 (2010-09-15) |
Le Sunday 26 Jan 2014 à 11:12:38 (+0800), Hu Tao a écrit :
> When cluster size is big enough it can lead to an offset overflow
> in qcow2_alloc_clusters_at(). This patch fixes it.
>
> The allocation is stopped each time at L2 table boundary
> (see handle_alloc()), so the possible maximum bytes could be
>
> 2^(cluster_bits - 3 + cluster_bits)
>
> cluster_bits - 3 is used to compute the number of entry by L2
> and the additional cluster_bits is to take into account each
> clusters referenced by the L2 entries.
>
> so int is safe for cluster_bits<=17, unsafe otherwise.
>
> Reviewed-by: Max Reitz <address@hidden>
> Signed-off-by: Hu Tao <address@hidden>
> ---
> block/qcow2-refcount.c | 8 +++++++-
> 1 file changed, 7 insertions(+), 1 deletion(-)
>
> diff --git a/block/qcow2-refcount.c b/block/qcow2-refcount.c
> index c974abe..8712d8b 100644
> --- a/block/qcow2-refcount.c
> +++ b/block/qcow2-refcount.c
> @@ -676,7 +676,13 @@ int qcow2_alloc_clusters_at(BlockDriverState *bs,
> uint64_t offset,
> BDRVQcowState *s = bs->opaque;
> uint64_t cluster_index;
> uint64_t old_free_cluster_index;
> - int i, refcount, ret;
> + uint64_t i;
> + int refcount, ret;
> +
> + assert(nb_clusters >= 0);
> + if (nb_clusters == 0) {
> + return 0;
> + }
>
> /* Check how many clusters there are free */
> cluster_index = offset >> s->cluster_bits;
> --
> 1.8.5.2.229.g4448466
>
Reviewed-by: Benoit Canet <address@hidden>