[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH v2 8/8] qcow2: Read outside array bounds in qcow
From: |
Eric Blake |
Subject: |
Re: [Qemu-devel] [PATCH v2 8/8] qcow2: Read outside array bounds in qcow2_pre_write_overlap_check() |
Date: |
Fri, 31 Aug 2018 11:53:10 -0500 |
User-agent: |
Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 |
On 08/31/2018 11:36 AM, Liam Merwick wrote:
The commit for 0e4e4318eaa5 increments QCOW2_OL_MAX_BITNR but does not
add an array entry for QCOW2_OL_BITMAP_DIRECTORY_BITNR to metadata_ol_names[].
As a result, an array dereference of metadata_ol_names[8] in
qcow2_pre_write_overlap_check() could result in a read outside of the array
bounds.
Fixes: 0e4e4318eaa5 ('qcow2: add overlap check for bitmap directory')
Cc: Vladimir Sementsov-Ogievskiy <address@hidden>
Signed-off-by: Liam Merwick <address@hidden>
---
block/qcow2-refcount.c | 26 ++++++++++++++++++--------
1 file changed, 18 insertions(+), 8 deletions(-)
+
+/*
+ * Catch at compile time the case where an overlap detection bit
+ * was added to QCow2MetadataOverlap in block/qcow2.h but a
+ * corresponding entry to metadata_ol_names[] wasn't added.
+ */
I'm not sure the comment adds much value. I'd be fine with dropping it.
+QEMU_BUILD_BUG_ON(QCOW2_OL_MAX_BITNR !=
+ (sizeof(metadata_ol_names) / sizeof(metadata_ol_names[0])));
We have a macro for that. Spell this:
QEMU_BUILD_BUG_ON(QCOW2_OL_MAX_BITNR != ARRAY_SIZE(metadata_ol_names));
and then you can have
Reviewed-by: Eric Blake <address@hidden>
--
Eric Blake, Principal Software Engineer
Red Hat, Inc. +1-919-301-3266
Virtualization: qemu.org | libvirt.org
- [Qemu-devel] [PATCH v2 0/8] off-by-one and NULL pointer accesses detected by static analysis, Liam Merwick, 2018/08/31
- [Qemu-devel] [PATCH v2 3/8] block: Null pointer dereference in blk_root_get_parent_desc(), Liam Merwick, 2018/08/31
- [Qemu-devel] [PATCH v2 4/8] qemu-img: potential Null pointer deref in img_commit(), Liam Merwick, 2018/08/31
- [Qemu-devel] [PATCH v2 2/8] job: Fix off-by-one assert checks for JobSTT and JobVerbTable, Liam Merwick, 2018/08/31
- [Qemu-devel] [PATCH v2 8/8] qcow2: Read outside array bounds in qcow2_pre_write_overlap_check(), Liam Merwick, 2018/08/31
- Re: [Qemu-devel] [PATCH v2 8/8] qcow2: Read outside array bounds in qcow2_pre_write_overlap_check(),
Eric Blake <=
- [Qemu-devel] [PATCH v2 1/8] configure: Provide option to explicitly disable AVX2, Liam Merwick, 2018/08/31
- [Qemu-devel] [PATCH v2 6/8] block: dump_qlist() may dereference a Null pointer, Liam Merwick, 2018/08/31
- [Qemu-devel] [PATCH v2 7/8] io: potential unnecessary check in qio_channel_command_new_spawn(), Liam Merwick, 2018/08/31
- [Qemu-devel] [PATCH v2 5/8] block: Fix potential Null pointer dereferences in vvfat.c, Liam Merwick, 2018/08/31