Patchwork [PULL,18/31] qcow2: Avoid overflow in alloc_clusters_noref()

login
register
mail settings
Submitter Kevin Wolf
Date April 30, 2014, 6:23 p.m.
Message ID <1398882243-14783-19-git-send-email-kwolf@redhat.com>
Download mbox | patch
Permalink /patch/344269/
State New
Headers show

Comments

Kevin Wolf - April 30, 2014, 6:23 p.m.
From: Max Reitz <mreitz@redhat.com>

alloc_clusters_noref() stores the cluster index in a uint64_t. However,
offsets are often represented as int64_t (as for example the return
value of alloc_clusters_noref() itself demonstrates). Therefore, we
should make sure all offsets in the allocated range of clusters are
representable using int64_t without overflows.

Signed-off-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/qcow2-refcount.c | 7 +++++++
 1 file changed, 7 insertions(+)

Patch

diff --git a/block/qcow2-refcount.c b/block/qcow2-refcount.c
index a37ee45..d2cb6a8 100644
--- a/block/qcow2-refcount.c
+++ b/block/qcow2-refcount.c
@@ -653,6 +653,13 @@  retry:
             goto retry;
         }
     }
+
+    /* Make sure that all offsets in the "allocated" range are representable
+     * in an int64_t */
+    if (s->free_cluster_index - 1 > (INT64_MAX >> s->cluster_bits)) {
+        return -EFBIG;
+    }
+
 #ifdef DEBUG_ALLOC2
     fprintf(stderr, "alloc_clusters: size=%" PRId64 " -> %" PRId64 "\n",
             size,