mirrors/qemu
0
0
Fork 0
mirror of https://github.com/qemu/qemu.git synced 2024-11-25 20:03:37 +08:00
Code Issues Packages Projects Releases Wiki Activity

qcow2: fix offset overflow in qcow2_alloc_clusters_at()

Browse Source 
When cluster size is big enough it can lead to an offset overflow
in qcow2_alloc_clusters_at(). This patch fixes it.

The allocation is stopped each time at L2 table boundary
(see handle_alloc()), so the possible maximum bytes could be

  2^(cluster_bits - 3 + cluster_bits)

cluster_bits - 3 is used to compute the number of entry by L2
and the additional cluster_bits is to take into account each
clusters referenced by the L2 entries.

so int is safe for cluster_bits<=17, unsafe otherwise.

Signed-off-by: Hu Tao <hutao@cn.fujitsu.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Benoit Canet <benoit@irqsave.net>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
This commit is contained in:
Hu Tao 2014-01-26 11:12:38 +08:00 committed by Kevin Wolf
parent 16f0587e0a
commit 33304ec9fa
1 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
block/qcow2-refcount.c
View File

@ -676,7 +676,13 @@ int qcow2_alloc_clusters_at(BlockDriverState *bs, uint64_t offset,
BDRVQcowState *s = bs->opaque;
uint64_t cluster_index;
uint64_t old_free_cluster_index;
int i, refcount, ret;
uint64_t i;
int refcount, ret;
assert(nb_clusters >= 0);
if (nb_clusters == 0) {
return 0;
}
/* Check how many clusters there are free */
cluster_index = offset >> s->cluster_bits;