From patchwork Fri Nov 11 16:55:03 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Kevin Wolf X-Patchwork-Id: 693807 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [IPv6:2001:4830:134:3::11]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 3tFmQr3jVKz9t2D for ; Sat, 12 Nov 2016 04:01:24 +1100 (AEDT) Received: from localhost ([::1]:54013 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1c5FCb-0004tn-NF for incoming@patchwork.ozlabs.org; Fri, 11 Nov 2016 12:01:21 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:59367) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1c5F6q-0006JT-RU for qemu-devel@nongnu.org; Fri, 11 Nov 2016 11:55:28 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1c5F6q-0002c0-5f for qemu-devel@nongnu.org; Fri, 11 Nov 2016 11:55:24 -0500 Received: from mx1.redhat.com ([209.132.183.28]:53376) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1c5F6n-0002aD-RD; Fri, 11 Nov 2016 11:55:21 -0500 Received: from int-mx09.intmail.prod.int.phx2.redhat.com (int-mx09.intmail.prod.int.phx2.redhat.com [10.5.11.22]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 0CE313D95F; Fri, 11 Nov 2016 16:55:21 +0000 (UTC) Received: from noname.redhat.com (ovpn-116-63.ams2.redhat.com [10.36.116.63]) by int-mx09.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id uABGtD4D010087; Fri, 11 Nov 2016 11:55:19 -0500 From: Kevin Wolf To: qemu-block@nongnu.org Date: Fri, 11 Nov 2016 17:55:03 +0100 Message-Id: <1478883311-24052-5-git-send-email-kwolf@redhat.com> In-Reply-To: <1478883311-24052-1-git-send-email-kwolf@redhat.com> References: <1478883311-24052-1-git-send-email-kwolf@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.68 on 10.5.11.22 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.30]); Fri, 11 Nov 2016 16:55:21 +0000 (UTC) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 209.132.183.28 Subject: [Qemu-devel] [PULL 04/12] raw_bsd: move check to prevent overflow X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: kwolf@redhat.com, qemu-devel@nongnu.org, stefanha@redhat.com Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: "Qemu-devel" From: Tomáš Golembiovský When only offset is specified but no size and the offset is greater than the real size of the containing device an overflow occurs when parsing the options. This overflow is harmless because we do check for this exact situation little bit later, but it leads to an error message with weird values. It is better to do the check is sooner and prevent the overflow. Signed-off-by: Tomáš Golembiovský Signed-off-by: Kevin Wolf --- block/raw_bsd.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/block/raw_bsd.c b/block/raw_bsd.c index 7c9bebb..cf7a560 100644 --- a/block/raw_bsd.c +++ b/block/raw_bsd.c @@ -91,6 +91,14 @@ static int raw_read_options(QDict *options, BlockDriverState *bs, } s->offset = qemu_opt_get_size(opts, "offset", 0); + if (s->offset > real_size) { + error_setg(errp, "Offset (%" PRIu64 ") cannot be greater than " + "size of the containing file (%" PRId64 ")", + s->offset, real_size); + ret = -EINVAL; + goto end; + } + if (qemu_opt_find(opts, "size") != NULL) { s->size = qemu_opt_get_size(opts, "size", 0); s->has_size = true; @@ -100,7 +108,7 @@ static int raw_read_options(QDict *options, BlockDriverState *bs, } /* Check size and offset */ - if (real_size < s->offset || (real_size - s->offset) < s->size) { + if ((real_size - s->offset) < s->size) { error_setg(errp, "The sum of offset (%" PRIu64 ") and size " "(%" PRIu64 ") has to be smaller or equal to the " " actual size of the containing file (%" PRId64 ")",