[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 29/32] qcow2: Do not overflow when writing an L1 sect
From: |
Kevin Wolf |
Subject: |
[Qemu-devel] [PULL 29/32] qcow2: Do not overflow when writing an L1 sector |
Date: |
Thu, 23 Oct 2014 22:42:36 +0200 |
From: Max Reitz <address@hidden>
While writing an L1 table sector, qcow2_write_l1_entry() copies the
respective range from s->l1_table to the local "buf" array. The size of
s->l1_table does not have to be a multiple of L1_ENTRIES_PER_SECTOR;
thus, limit the index which is used for copying all entries to the L1
size.
Cc: address@hidden
Signed-off-by: Max Reitz <address@hidden>
Reviewed-by: Peter Lieven <address@hidden>
Reviewed-by: Eric Blake <address@hidden>
Signed-off-by: Kevin Wolf <address@hidden>
---
block/qcow2-cluster.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/block/qcow2-cluster.c b/block/qcow2-cluster.c
index f7dd8c0..4d888c7 100644
--- a/block/qcow2-cluster.c
+++ b/block/qcow2-cluster.c
@@ -164,12 +164,14 @@ static int l2_load(BlockDriverState *bs, uint64_t
l2_offset,
int qcow2_write_l1_entry(BlockDriverState *bs, int l1_index)
{
BDRVQcowState *s = bs->opaque;
- uint64_t buf[L1_ENTRIES_PER_SECTOR];
+ uint64_t buf[L1_ENTRIES_PER_SECTOR] = { 0 };
int l1_start_index;
int i, ret;
l1_start_index = l1_index & ~(L1_ENTRIES_PER_SECTOR - 1);
- for (i = 0; i < L1_ENTRIES_PER_SECTOR; i++) {
+ for (i = 0; i < L1_ENTRIES_PER_SECTOR && l1_start_index + i < s->l1_size;
+ i++)
+ {
buf[i] = cpu_to_be64(s->l1_table[l1_start_index + i]);
}
--
1.8.3.1
- [Qemu-devel] [PULL 20/32] qcow2: Clean up after refcount rebuild, (continued)
- [Qemu-devel] [PULL 20/32] qcow2: Clean up after refcount rebuild, Kevin Wolf, 2014/10/23
- [Qemu-devel] [PULL 19/32] qcow2: Rebuild refcount structure during check, Kevin Wolf, 2014/10/23
- [Qemu-devel] [PULL 21/32] iotests: Fix test outputs, Kevin Wolf, 2014/10/23
- [Qemu-devel] [PULL 22/32] iotests: Add test for potentially damaging repairs, Kevin Wolf, 2014/10/23
- [Qemu-devel] [PULL 23/32] qcow2: Drop REFCOUNT_SHIFT, Kevin Wolf, 2014/10/23
- [Qemu-devel] [PULL 24/32] docs/qcow2: Correct refcount_block_entries, Kevin Wolf, 2014/10/23
- [Qemu-devel] [PULL 25/32] docs/qcow2: Limit refcount_order to [0, 6], Kevin Wolf, 2014/10/23
- [Qemu-devel] [PULL 27/32] qemu-io: Respect early image end for map, Kevin Wolf, 2014/10/23
- [Qemu-devel] [PULL 28/32] iotests: Add test for map commands, Kevin Wolf, 2014/10/23
- [Qemu-devel] [PULL 30/32] iotests: Add test for qcow2 L1 table update, Kevin Wolf, 2014/10/23
- [Qemu-devel] [PULL 29/32] qcow2: Do not overflow when writing an L1 sector,
Kevin Wolf <=
- [Qemu-devel] [PULL 26/32] block: Respect underlying file's EOF, Kevin Wolf, 2014/10/23
- [Qemu-devel] [PULL 31/32] block: char devices on FreeBSD are not behind a pager, Kevin Wolf, 2014/10/23
- [Qemu-devel] [PULL 32/32] qemu-img: Print error if check failed, Kevin Wolf, 2014/10/23
- Re: [Qemu-devel] [PULL 00/32] Block patches, Peter Maydell, 2014/10/24