diff mbox

[v2,2/3] qcow2: fix offset overflow in qcow2_alloc_clusters_at()

Message ID 2507a769d04e10bcadaa3b61096e9b79f8d39302.1390188943.git.hutao@cn.fujitsu.com
State New
Headers show

Commit Message

Hu Tao Jan. 20, 2014, 3:46 a.m. UTC 
When cluster size is big enough it can lead offset overflow
in qcow2_alloc_clusters_at(). This patch fixes it.

The allocation each time is stopped at L2 table boundary
(see handle_alloc()), so the possible maximum bytes could be

  2^(cluster_bits - 3 + cluster_bits)

so int is safe for cluster_bits<=17, unsafe otherwise.

Signed-off-by: Hu Tao <hutao@cn.fujitsu.com>
---
 block/qcow2-refcount.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)
diff mbox

Patch

diff --git a/block/qcow2-refcount.c b/block/qcow2-refcount.c
index c974abe..6c13369 100644
--- a/block/qcow2-refcount.c
+++ b/block/qcow2-refcount.c
@@ -676,7 +676,12 @@  int qcow2_alloc_clusters_at(BlockDriverState *bs, uint64_t offset,
     BDRVQcowState *s = bs->opaque;
     uint64_t cluster_index;
     uint64_t old_free_cluster_index;
-    int i, refcount, ret;
+    uint64_t i;
+    int refcount, ret;
+
+    if (nb_clusters <= 0) {
+        return -EINVAL;
+    }
 
     /* Check how many clusters there are free */
     cluster_index = offset >> s->cluster_bits;