Re: [PATCH v4 03/16] block: fix theoretical overflow in bdrv_init_padding()

[Eric Blake]

On 12/11/20 12:39 PM, Vladimir Sementsov-Ogievskiy wrote:
> Calculation of sum may theoretically overflow, so use 64bit type and
> add some good assertions.
> 
> Use int64_t constantly.
> 
> Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
> ---
>  block/io.c | 8 ++++++--
>  1 file changed, 6 insertions(+), 2 deletions(-)
> 
> diff --git a/block/io.c b/block/io.c
> index 21e8a50725..d9bc67f1b0 100644
> --- a/block/io.c
> +++ b/block/io.c
> @@ -1537,8 +1537,12 @@ static bool bdrv_init_padding(BlockDriverState *bs,
>                                int64_t offset, int64_t bytes,
>                                BdrvRequestPadding *pad)
>  {
> -    uint64_t align = bs->bl.request_alignment;
> -    size_t sum;
> +    int64_t align = bs->bl.request_alignment;
> +    int64_t sum;
> +
> +    bdrv_check_request(offset, bytes, &error_abort);
> +    assert(align <= INT_MAX); /* documented in block/block_int.h */
> +    assert(align * 2 <= SIZE_MAX); /* so we can allocate the buffer */

Would look better as assert(align <= SIZE_MAX / 2); but not technically
wrong as written because the earlier line proved align is less than 32
bits so align*2 can't overflow 63 bits.

Reviewed-by: Eric Blake <eblake@redhat.com>

-- 
Eric Blake, Principal Software Engineer
Red Hat, Inc.           +1-919-301-3226
Virtualization:  qemu.org | libvirt.org