Message ID | 1413465957-20865-2-git-send-email-mreitz@redhat.com |
---|---|
State | New |
Headers | show |
On 16.10.2014 15:25, Max Reitz wrote: > While writing an L1 table sector, qcow2_write_l1_entry() copies the > respective range from s->l1_table to the local "buf" array. The size of > s->l1_table does not have to be a multiple of L1_ENTRIES_PER_SECTOR; > thus, limit the index which is used for copying all entries to the L1 > size. > > Cc: qemu-stable@nongnu.org > Signed-off-by: Max Reitz <mreitz@redhat.com> > --- > block/qcow2-cluster.c | 6 ++++-- > 1 file changed, 4 insertions(+), 2 deletions(-) > > diff --git a/block/qcow2-cluster.c b/block/qcow2-cluster.c > index f7dd8c0..4d888c7 100644 > --- a/block/qcow2-cluster.c > +++ b/block/qcow2-cluster.c > @@ -164,12 +164,14 @@ static int l2_load(BlockDriverState *bs, uint64_t l2_offset, > int qcow2_write_l1_entry(BlockDriverState *bs, int l1_index) > { > BDRVQcowState *s = bs->opaque; > - uint64_t buf[L1_ENTRIES_PER_SECTOR]; > + uint64_t buf[L1_ENTRIES_PER_SECTOR] = { 0 }; > int l1_start_index; > int i, ret; > > l1_start_index = l1_index & ~(L1_ENTRIES_PER_SECTOR - 1); > - for (i = 0; i < L1_ENTRIES_PER_SECTOR; i++) { > + for (i = 0; i < L1_ENTRIES_PER_SECTOR && l1_start_index + i < s->l1_size; > + i++) > + { > buf[i] = cpu_to_be64(s->l1_table[l1_start_index + i]); > } > Reviewed-by: Peter Lieven <pl@kamp.de>
diff --git a/block/qcow2-cluster.c b/block/qcow2-cluster.c index f7dd8c0..4d888c7 100644 --- a/block/qcow2-cluster.c +++ b/block/qcow2-cluster.c @@ -164,12 +164,14 @@ static int l2_load(BlockDriverState *bs, uint64_t l2_offset, int qcow2_write_l1_entry(BlockDriverState *bs, int l1_index) { BDRVQcowState *s = bs->opaque; - uint64_t buf[L1_ENTRIES_PER_SECTOR]; + uint64_t buf[L1_ENTRIES_PER_SECTOR] = { 0 }; int l1_start_index; int i, ret; l1_start_index = l1_index & ~(L1_ENTRIES_PER_SECTOR - 1); - for (i = 0; i < L1_ENTRIES_PER_SECTOR; i++) { + for (i = 0; i < L1_ENTRIES_PER_SECTOR && l1_start_index + i < s->l1_size; + i++) + { buf[i] = cpu_to_be64(s->l1_table[l1_start_index + i]); }
While writing an L1 table sector, qcow2_write_l1_entry() copies the respective range from s->l1_table to the local "buf" array. The size of s->l1_table does not have to be a multiple of L1_ENTRIES_PER_SECTOR; thus, limit the index which is used for copying all entries to the L1 size. Cc: qemu-stable@nongnu.org Signed-off-by: Max Reitz <mreitz@redhat.com> --- block/qcow2-cluster.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)