| Message ID | 1532433124-25881-1-git-send-email-thuth@redhat.com |
|---|---|
| State | New |
| Headers | show |
| Series | [v2] block/vvfat: Fix crash when reporting error about too many files in directory | expand |
On 2018-07-24 13:52, Thomas Huth wrote: > When using the vvfat driver with a directory that contains too many files, > QEMU currently crashes. This can be triggered like this for example: > > mkdir /tmp/vvfattest > cd /tmp/vvfattest > for ((x=0;x<=513;x++)); do mkdir $x; done > qemu-system-x86_64 -drive \ > file.driver=vvfat,file.dir=.,read-only=on,media=cdrom > > Seems like read_directory() is changing the mapping->path variable. Make > sure we use the right pointer instead. > > Signed-off-by: Thomas Huth <thuth@redhat.com> > --- > block/vvfat.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/block/vvfat.c b/block/vvfat.c > index fc41841..f2e7d50 100644 > --- a/block/vvfat.c > +++ b/block/vvfat.c > @@ -973,10 +973,10 @@ static int init_directories(BDRVVVFATState* s, > mapping = array_get(&(s->mapping), i); > > if (mapping->mode & MODE_DIRECTORY) { > + char *path = mapping->path; > mapping->begin = cluster; > if(read_directory(s, i)) { > - error_setg(errp, "Could not read directory %s", > - mapping->path); > + error_setg(errp, "Could not read directory %s", path); > return -1; > } > mapping = array_get(&(s->mapping), i); > Ping?
Am 24.07.2018 um 13:52 hat Thomas Huth geschrieben: > When using the vvfat driver with a directory that contains too many files, > QEMU currently crashes. This can be triggered like this for example: > > mkdir /tmp/vvfattest > cd /tmp/vvfattest > for ((x=0;x<=513;x++)); do mkdir $x; done > qemu-system-x86_64 -drive \ > file.driver=vvfat,file.dir=.,read-only=on,media=cdrom > > Seems like read_directory() is changing the mapping->path variable. Make > sure we use the right pointer instead. > > Signed-off-by: Thomas Huth <thuth@redhat.com> Thanks, applied to the block branch. Kevin
diff --git a/block/vvfat.c b/block/vvfat.c index fc41841..f2e7d50 100644 --- a/block/vvfat.c +++ b/block/vvfat.c @@ -973,10 +973,10 @@ static int init_directories(BDRVVVFATState* s, mapping = array_get(&(s->mapping), i); if (mapping->mode & MODE_DIRECTORY) { + char *path = mapping->path; mapping->begin = cluster; if(read_directory(s, i)) { - error_setg(errp, "Could not read directory %s", - mapping->path); + error_setg(errp, "Could not read directory %s", path); return -1; } mapping = array_get(&(s->mapping), i);
When using the vvfat driver with a directory that contains too many files, QEMU currently crashes. This can be triggered like this for example: mkdir /tmp/vvfattest cd /tmp/vvfattest for ((x=0;x<=513;x++)); do mkdir $x; done qemu-system-x86_64 -drive \ file.driver=vvfat,file.dir=.,read-only=on,media=cdrom Seems like read_directory() is changing the mapping->path variable. Make sure we use the right pointer instead. Signed-off-by: Thomas Huth <thuth@redhat.com> --- block/vvfat.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)