[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH 47/88] qcow2: Do not overflow when writing an L1 sec
From: |
Michael Roth |
Subject: |
[Qemu-devel] [PATCH 47/88] qcow2: Do not overflow when writing an L1 sector |
Date: |
Thu, 8 Jan 2015 11:33:51 -0600 |
From: Max Reitz <address@hidden>
While writing an L1 table sector, qcow2_write_l1_entry() copies the
respective range from s->l1_table to the local "buf" array. The size of
s->l1_table does not have to be a multiple of L1_ENTRIES_PER_SECTOR;
thus, limit the index which is used for copying all entries to the L1
size.
Cc: address@hidden
Signed-off-by: Max Reitz <address@hidden>
Reviewed-by: Peter Lieven <address@hidden>
Reviewed-by: Eric Blake <address@hidden>
Signed-off-by: Kevin Wolf <address@hidden>
(cherry picked from commit a1391444fe1cfef14976458f3293a2c6945e725c)
Signed-off-by: Michael Roth <address@hidden>
---
block/qcow2-cluster.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/block/qcow2-cluster.c b/block/qcow2-cluster.c
index 4208dc0..26827a2 100644
--- a/block/qcow2-cluster.c
+++ b/block/qcow2-cluster.c
@@ -158,12 +158,14 @@ static int l2_load(BlockDriverState *bs, uint64_t
l2_offset,
int qcow2_write_l1_entry(BlockDriverState *bs, int l1_index)
{
BDRVQcowState *s = bs->opaque;
- uint64_t buf[L1_ENTRIES_PER_SECTOR];
+ uint64_t buf[L1_ENTRIES_PER_SECTOR] = { 0 };
int l1_start_index;
int i, ret;
l1_start_index = l1_index & ~(L1_ENTRIES_PER_SECTOR - 1);
- for (i = 0; i < L1_ENTRIES_PER_SECTOR; i++) {
+ for (i = 0; i < L1_ENTRIES_PER_SECTOR && l1_start_index + i < s->l1_size;
+ i++)
+ {
buf[i] = cpu_to_be64(s->l1_table[l1_start_index + i]);
}
--
1.9.1
- [Qemu-devel] [PATCH 43/88] vmware-vga: add vmsvga_verify_rect, (continued)
- [Qemu-devel] [PATCH 43/88] vmware-vga: add vmsvga_verify_rect, Michael Roth, 2015/01/08
- [Qemu-devel] [PATCH 37/88] virtio-rng: fix virtio-rng child refcount in transports, Michael Roth, 2015/01/08
- [Qemu-devel] [PATCH 41/88] pc: Fix disabling of vapic for compat PC models, Michael Roth, 2015/01/08
- [Qemu-devel] [PATCH 48/88] libcacard: don't free sign buffer while sign op is pending, Michael Roth, 2015/01/08
- [Qemu-devel] [PATCH 46/88] vmware-vga: use vmsvga_verify_rect in vmsvga_fill_rect, Michael Roth, 2015/01/08
- [Qemu-devel] [PATCH 50/88] vnc: sanitize bits_per_pixel from the client, Michael Roth, 2015/01/08
- [Qemu-devel] [PATCH 40/88] virtio-9p: fix virtio-9p child refcount in transports, Michael Roth, 2015/01/08
- [Qemu-devel] [PATCH 45/88] vmware-vga: use vmsvga_verify_rect in vmsvga_copy_rect, Michael Roth, 2015/01/08
- [Qemu-devel] [PATCH 51/88] virtio-scsi: sense in virtio_scsi_command_complete, Michael Roth, 2015/01/08
- [Qemu-devel] [PATCH 52/88] tcg/mips: fix store softmmu slow path, Michael Roth, 2015/01/08
- [Qemu-devel] [PATCH 47/88] qcow2: Do not overflow when writing an L1 sector,
Michael Roth <=
- [Qemu-devel] [PATCH 49/88] Make qemu_shutdown_requested signal-safe, Michael Roth, 2015/01/08
- [Qemu-devel] [PATCH 54/88] hw/xtensa/xtfpga: treat uImage load address as virtual, Michael Roth, 2015/01/08
- [Qemu-devel] [PATCH 53/88] hw/core/loader: implement address translation in uimage loader, Michael Roth, 2015/01/08
- [Qemu-devel] [PATCH 57/88] esp-pci: fixup deadlock with linux, Michael Roth, 2015/01/08
- [Qemu-devel] [PATCH 19/88] virtio-balloon: fix integer overflow in memory stats feature, Michael Roth, 2015/01/08
- [Qemu-devel] [PATCH 56/88] hw/ppc/spapr_pci.c: Avoid functions not in glib 2.12 (g_hash_table_iter_*), Michael Roth, 2015/01/08
- [Qemu-devel] [PATCH 58/88] target-xtensa: add missing window check for entry, Michael Roth, 2015/01/08
- [Qemu-devel] [PATCH 21/88] ivshmem: Check ivshmem_read() size argument, Michael Roth, 2015/01/08
- [Qemu-devel] [PATCH 23/88] ivshmem: Fix potential OOB r/w access, Michael Roth, 2015/01/08
- [Qemu-devel] [PATCH 55/88] snapshot: add bdrv_drain_all() to bdrv_snapshot_delete() to avoid concurrency problem, Michael Roth, 2015/01/08