[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 55/59] block: vhdx - fix reading beyond pointer durin
From: |
Stefan Hajnoczi |
Subject: |
[Qemu-devel] [PULL 55/59] block: vhdx - fix reading beyond pointer during image creation |
Date: |
Fri, 19 Sep 2014 15:42:14 +0100 |
From: Jeff Cody <address@hidden>
In vhdx_create_metadata(), we allocate 40 bytes to entry_buffer for
the various metadata table entries. However, we write out 64kB from
that buffer into the new file. Only write out the correct 40 bytes.
Signed-off-by: Jeff Cody <address@hidden>
Reviewed-by: Markus Armbruster <address@hidden>
Signed-off-by: Stefan Hajnoczi <address@hidden>
---
block/vhdx.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
diff --git a/block/vhdx.c b/block/vhdx.c
index d9aa2c1..22a4fb8 100644
--- a/block/vhdx.c
+++ b/block/vhdx.c
@@ -1408,6 +1408,12 @@ exit:
return ret;
}
+#define VHDX_METADATA_ENTRY_BUFFER_SIZE \
+ (sizeof(VHDXFileParameters)
+\
+ sizeof(VHDXVirtualDiskSize)
+\
+ sizeof(VHDXPage83Data)
+\
+ sizeof(VHDXVirtualDiskLogicalSectorSize)
+\
+ sizeof(VHDXVirtualDiskPhysicalSectorSize))
/*
* Create the Metadata entries.
@@ -1446,11 +1452,7 @@ static int vhdx_create_new_metadata(BlockDriverState *bs,
VHDXVirtualDiskLogicalSectorSize *mt_log_sector_size;
VHDXVirtualDiskPhysicalSectorSize *mt_phys_sector_size;
- entry_buffer = g_malloc0(sizeof(VHDXFileParameters) +
- sizeof(VHDXVirtualDiskSize) +
- sizeof(VHDXPage83Data) +
- sizeof(VHDXVirtualDiskLogicalSectorSize) +
- sizeof(VHDXVirtualDiskPhysicalSectorSize));
+ entry_buffer = g_malloc0(VHDX_METADATA_ENTRY_BUFFER_SIZE);
mt_file_params = entry_buffer;
offset += sizeof(VHDXFileParameters);
@@ -1531,7 +1533,7 @@ static int vhdx_create_new_metadata(BlockDriverState *bs,
}
ret = bdrv_pwrite(bs, metadata_offset + (64 * KiB), entry_buffer,
- VHDX_HEADER_BLOCK_SIZE);
+ VHDX_METADATA_ENTRY_BUFFER_SIZE);
if (ret < 0) {
goto exit;
}
@@ -1726,7 +1728,6 @@ static int vhdx_create_new_region_table(BlockDriverState
*bs,
goto exit;
}
-
exit:
g_free(s);
g_free(buffer);
@@ -1877,7 +1878,6 @@ static int vhdx_create(const char *filename, QemuOpts
*opts, Error **errp)
}
-
delete_and_exit:
bdrv_unref(bs);
exit:
--
1.9.3
- [Qemu-devel] [PULL 43/59] fuzz: Add fuzzing functions for entries of refcount table and blocks, (continued)
- [Qemu-devel] [PULL 43/59] fuzz: Add fuzzing functions for entries of refcount table and blocks, Stefan Hajnoczi, 2014/09/19
- [Qemu-devel] [PULL 46/59] ahci: MSI capability should be at 0x80, not 0x50., Stefan Hajnoczi, 2014/09/19
- [Qemu-devel] [PULL 45/59] ahci: Adding basic functionality qtest., Stefan Hajnoczi, 2014/09/19
- [Qemu-devel] [PULL 47/59] ahci: Add test_pci_spec to ahci-test., Stefan Hajnoczi, 2014/09/19
- [Qemu-devel] [PULL 48/59] ahci: add test_pci_enable to ahci-test., Stefan Hajnoczi, 2014/09/19
- [Qemu-devel] [PULL 49/59] ahci: properly shadow the TFD register, Stefan Hajnoczi, 2014/09/19
- [Qemu-devel] [PULL 50/59] ahci: Add test_hba_spec to ahci-test., Stefan Hajnoczi, 2014/09/19
- [Qemu-devel] [PULL 51/59] ahci: Add test_hba_enable to ahci-test., Stefan Hajnoczi, 2014/09/19
- [Qemu-devel] [PULL 52/59] ahci: Add test_identify case to ahci-test., Stefan Hajnoczi, 2014/09/19
- [Qemu-devel] [PULL 54/59] block: delete cow block driver, Stefan Hajnoczi, 2014/09/19
- [Qemu-devel] [PULL 55/59] block: vhdx - fix reading beyond pointer during image creation,
Stefan Hajnoczi <=
- [Qemu-devel] [PULL 56/59] async: aio_context_new(): Handle event_notifier_init failure, Stefan Hajnoczi, 2014/09/19
- [Qemu-devel] [PULL 57/59] virtio: Import virtio_vring.h, Stefan Hajnoczi, 2014/09/19
- [Qemu-devel] [PULL 53/59] block/archipelago: Fix typo in qemu_archipelago_truncate(), Stefan Hajnoczi, 2014/09/19
- [Qemu-devel] [PULL 58/59] vring: Better error handling if num is too large, Stefan Hajnoczi, 2014/09/19
- [Qemu-devel] [PULL 59/59] block: Always compile virtio-blk dataplane, Stefan Hajnoczi, 2014/09/19
- [Qemu-devel] [PULL 41/59] qapi/block-core: Add "new" qcow2 options, Stefan Hajnoczi, 2014/09/19
- [Qemu-devel] [PULL 40/59] qcow2: Add overlap-check.template option, Stefan Hajnoczi, 2014/09/19
- [Qemu-devel] [PULL 42/59] docs: List all image elements currently supported by the fuzzer, Stefan Hajnoczi, 2014/09/19
- Re: [Qemu-devel] [PULL 00/59] Block patches, Peter Maydell, 2014/09/19