qemu-devel
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Qemu-devel] [PATCH v2 8/8] qcow2: Read outside array bounds in qcow


From: Liam Merwick
Subject: Re: [Qemu-devel] [PATCH v2 8/8] qcow2: Read outside array bounds in qcow2_pre_write_overlap_check()
Date: Fri, 31 Aug 2018 19:16:01 +0100
User-agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.9.1



On 31/08/18 17:53, Eric Blake wrote:
On 08/31/2018 11:36 AM, Liam Merwick wrote:
The commit for 0e4e4318eaa5 increments QCOW2_OL_MAX_BITNR but does not
add an array entry for QCOW2_OL_BITMAP_DIRECTORY_BITNR to metadata_ol_names[].
As a result, an array dereference of metadata_ol_names[8] in
qcow2_pre_write_overlap_check() could result in a read outside of the array bounds.

Fixes: 0e4e4318eaa5 ('qcow2: add overlap check for bitmap directory')

Cc: Vladimir Sementsov-Ogievskiy <address@hidden>
Signed-off-by: Liam Merwick <address@hidden>
---
  block/qcow2-refcount.c | 26 ++++++++++++++++++--------
  1 file changed, 18 insertions(+), 8 deletions(-)


+
+/*
+ * Catch at compile time the case where an overlap detection bit
+ * was added to QCow2MetadataOverlap in block/qcow2.h but a
+ * corresponding entry to metadata_ol_names[] wasn't added.
+ */

I'm not sure the comment adds much value.  I'd be fine with dropping it.

+QEMU_BUILD_BUG_ON(QCOW2_OL_MAX_BITNR !=
+    (sizeof(metadata_ol_names) / sizeof(metadata_ol_names[0])));

We have a macro for that.  Spell this:

QEMU_BUILD_BUG_ON(QCOW2_OL_MAX_BITNR != ARRAY_SIZE(metadata_ol_names));

and then you can have

Reviewed-by: Eric Blake <address@hidden>


Thanks, I've updated those and removed the double space in patch6. Will be in upcoming v3

Regards,
Liam



reply via email to

[Prev in Thread] Current Thread [Next in Thread]