From patchwork Wed Mar 26 12:05:29 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stefan Hajnoczi X-Patchwork-Id: 333864 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [IPv6:2001:4830:134:3::11]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 951A014008D for ; Wed, 26 Mar 2014 23:52:54 +1100 (EST) Received: from localhost ([::1]:47398 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WSmf3-0005Hg-Bp for incoming@patchwork.ozlabs.org; Wed, 26 Mar 2014 08:10:25 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:49785) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WSmbJ-0000Xa-4M for qemu-devel@nongnu.org; Wed, 26 Mar 2014 08:06:39 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1WSmbD-0003t2-4L for qemu-devel@nongnu.org; Wed, 26 Mar 2014 08:06:33 -0400 Received: from mx1.redhat.com ([209.132.183.28]:2595) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WSmbC-0003sx-Sj; Wed, 26 Mar 2014 08:06:27 -0400 Received: from int-mx01.intmail.prod.int.phx2.redhat.com (int-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.11]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id s2QC6QFR031448 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Wed, 26 Mar 2014 08:06:26 -0400 Received: from localhost (dhcp-64-106.muc.redhat.com [10.32.64.106]) by int-mx01.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id s2QC6P7V009409; Wed, 26 Mar 2014 08:06:25 -0400 From: Stefan Hajnoczi To: Date: Wed, 26 Mar 2014 13:05:29 +0100 Message-Id: <1395835569-21193-8-git-send-email-stefanha@redhat.com> In-Reply-To: <1395835569-21193-1-git-send-email-stefanha@redhat.com> References: <1395835569-21193-1-git-send-email-stefanha@redhat.com> X-Scanned-By: MIMEDefang 2.67 on 10.5.11.11 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x X-Received-From: 209.132.183.28 Cc: Kevin Wolf , pmatouse@redhat.com, qemu-stable@nongnu.org, Stefan Hajnoczi Subject: [Qemu-devel] [PATCH for-2.0 07/47] block/cloop: fix offsets[] size off-by-one X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org cloop stores the number of compressed blocks in the n_blocks header field. The file actually contains n_blocks + 1 offsets, where the extra offset is the end-of-file offset. The following line in cloop_read_block() results in an out-of-bounds offsets[] access: uint32_t bytes = s->offsets[block_num + 1] - s->offsets[block_num]; This patch allocates and loads the extra offset so that cloop_read_block() works correctly when the last block is accessed. Notice that we must free s->offsets[] unconditionally now since there is always an end-of-file offset. Signed-off-by: Stefan Hajnoczi Signed-off-by: Kevin Wolf Reviewed-by: Max Reitz --- block/cloop.c | 12 +++++------- tests/qemu-iotests/075 | 5 +++++ tests/qemu-iotests/075.out | 4 ++++ 3 files changed, 14 insertions(+), 7 deletions(-) diff --git a/block/cloop.c b/block/cloop.c index 55a804f..b6ad50f 100644 --- a/block/cloop.c +++ b/block/cloop.c @@ -99,14 +99,14 @@ static int cloop_open(BlockDriverState *bs, QDict *options, int flags, s->n_blocks = be32_to_cpu(s->n_blocks); /* read offsets */ - if (s->n_blocks > UINT32_MAX / sizeof(uint64_t)) { + if (s->n_blocks > (UINT32_MAX - 1) / sizeof(uint64_t)) { /* Prevent integer overflow */ error_setg(errp, "n_blocks %u must be %zu or less", s->n_blocks, - UINT32_MAX / sizeof(uint64_t)); + (UINT32_MAX - 1) / sizeof(uint64_t)); return -EINVAL; } - offsets_size = s->n_blocks * sizeof(uint64_t); + offsets_size = (s->n_blocks + 1) * sizeof(uint64_t); if (offsets_size > 512 * 1024 * 1024) { /* Prevent ridiculous offsets_size which causes memory allocation to * fail or overflows bdrv_pread() size. In practice the 512 MB @@ -123,7 +123,7 @@ static int cloop_open(BlockDriverState *bs, QDict *options, int flags, goto fail; } - for(i=0;in_blocks;i++) { + for (i = 0; i < s->n_blocks + 1; i++) { uint64_t size; s->offsets[i] = be64_to_cpu(s->offsets[i]); @@ -243,9 +243,7 @@ static coroutine_fn int cloop_co_read(BlockDriverState *bs, int64_t sector_num, static void cloop_close(BlockDriverState *bs) { BDRVCloopState *s = bs->opaque; - if (s->n_blocks > 0) { - g_free(s->offsets); - } + g_free(s->offsets); g_free(s->compressed_block); g_free(s->uncompressed_block); inflateEnd(&s->zstream); diff --git a/tests/qemu-iotests/075 b/tests/qemu-iotests/075 index d74fb33..40032c5 100755 --- a/tests/qemu-iotests/075 +++ b/tests/qemu-iotests/075 @@ -52,6 +52,11 @@ _use_sample_img simple-pattern.cloop.bz2 $QEMU_IO -c "read 0 512" $TEST_IMG 2>&1 | _filter_qemu_io | _filter_testdir echo +echo "== check that the last sector can be read ==" +_use_sample_img simple-pattern.cloop.bz2 +$QEMU_IO -c "read $((1024 * 1024 - 512)) 512" $TEST_IMG 2>&1 | _filter_qemu_io | _filter_testdir + +echo echo "== block_size must be a multiple of 512 ==" _use_sample_img simple-pattern.cloop.bz2 poke_file "$TEST_IMG" "$block_size_offset" "\x00\x00\x02\x01" diff --git a/tests/qemu-iotests/075.out b/tests/qemu-iotests/075.out index 911cd3b..5f1d6c1 100644 --- a/tests/qemu-iotests/075.out +++ b/tests/qemu-iotests/075.out @@ -4,6 +4,10 @@ QA output created by 075 read 512/512 bytes at offset 0 512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) +== check that the last sector can be read == +read 512/512 bytes at offset 1048064 +512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) + == block_size must be a multiple of 512 == qemu-io: can't open device TEST_DIR/simple-pattern.cloop: block_size 513 must be a multiple of 512 no file open, try 'help open'