|
 |
05bba0 |
From 5cefc50d497d347c2352d785657b04db99e06ec8 Mon Sep 17 00:00:00 2001
|
|
|
05bba0 |
From: Max Reitz <mreitz@redhat.com>
|
|
|
05bba0 |
Date: Sat, 13 Jun 2015 16:22:07 +0200
|
|
|
05bba0 |
Subject: [PATCH 13/42] qcow2: Do not overflow when writing an L1 sector
|
|
|
05bba0 |
|
|
|
05bba0 |
Message-id: <1434212556-3927-14-git-send-email-mreitz@redhat.com>
|
|
|
05bba0 |
Patchwork-id: 66032
|
|
|
05bba0 |
O-Subject: [RHEL-7.2 qemu-kvm PATCH 13/42] qcow2: Do not overflow when writing an L1 sector
|
|
|
05bba0 |
Bugzilla: 1129893
|
|
|
05bba0 |
RH-Acked-by: Jeffrey Cody <jcody@redhat.com>
|
|
|
05bba0 |
RH-Acked-by: Fam Zheng <famz@redhat.com>
|
|
|
05bba0 |
RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
|
|
|
05bba0 |
|
|
|
05bba0 |
BZ: 1129893
|
|
|
05bba0 |
|
|
|
05bba0 |
While writing an L1 table sector, qcow2_write_l1_entry() copies the
|
|
|
05bba0 |
respective range from s->l1_table to the local "buf" array. The size of
|
|
|
05bba0 |
s->l1_table does not have to be a multiple of L1_ENTRIES_PER_SECTOR;
|
|
|
05bba0 |
thus, limit the index which is used for copying all entries to the L1
|
|
|
05bba0 |
size.
|
|
|
05bba0 |
|
|
|
05bba0 |
Cc: qemu-stable@nongnu.org
|
|
|
05bba0 |
Signed-off-by: Max Reitz <mreitz@redhat.com>
|
|
|
05bba0 |
Reviewed-by: Peter Lieven <pl@kamp.de>
|
|
|
05bba0 |
Reviewed-by: Eric Blake <eblake@redhat.com>
|
|
|
05bba0 |
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
|
|
|
05bba0 |
(cherry picked from commit a1391444fe1cfef14976458f3293a2c6945e725c)
|
|
|
05bba0 |
|
|
|
05bba0 |
Signed-off-by: Max Reitz <mreitz@redhat.com>
|
|
|
05bba0 |
Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
|
|
|
05bba0 |
---
|
|
|
05bba0 |
block/qcow2-cluster.c | 6 ++++--
|
|
|
05bba0 |
1 file changed, 4 insertions(+), 2 deletions(-)
|
|
|
05bba0 |
|
|
|
05bba0 |
diff --git a/block/qcow2-cluster.c b/block/qcow2-cluster.c
|
|
|
05bba0 |
index 0e3b8d7..053e9fe 100644
|
|
|
05bba0 |
--- a/block/qcow2-cluster.c
|
|
|
05bba0 |
+++ b/block/qcow2-cluster.c
|
|
|
05bba0 |
@@ -151,12 +151,14 @@ static int l2_load(BlockDriverState *bs, uint64_t l2_offset,
|
|
|
05bba0 |
int qcow2_write_l1_entry(BlockDriverState *bs, int l1_index)
|
|
|
05bba0 |
{
|
|
|
05bba0 |
BDRVQcowState *s = bs->opaque;
|
|
|
05bba0 |
- uint64_t buf[L1_ENTRIES_PER_SECTOR];
|
|
|
05bba0 |
+ uint64_t buf[L1_ENTRIES_PER_SECTOR] = { 0 };
|
|
|
05bba0 |
int l1_start_index;
|
|
|
05bba0 |
int i, ret;
|
|
|
05bba0 |
|
|
|
05bba0 |
l1_start_index = l1_index & ~(L1_ENTRIES_PER_SECTOR - 1);
|
|
|
05bba0 |
- for (i = 0; i < L1_ENTRIES_PER_SECTOR; i++) {
|
|
|
05bba0 |
+ for (i = 0; i < L1_ENTRIES_PER_SECTOR && l1_start_index + i < s->l1_size;
|
|
|
05bba0 |
+ i++)
|
|
|
05bba0 |
+ {
|
|
|
05bba0 |
buf[i] = cpu_to_be64(s->l1_table[l1_start_index + i]);
|
|
|
05bba0 |
}
|
|
|
05bba0 |
|
|
|
05bba0 |
--
|
|
|
05bba0 |
1.8.3.1
|
|
|
05bba0 |
|