mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

qcow2: Protect against some integer overflows in bdrv_check

Browse Source 
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
This commit is contained in:
Kevin Wolf 2014-03-26 13:05:52 +01:00 committed by Stefan Hajnoczi
parent bb572aefbd
commit 0abe740f1d
1 changed files with 9 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
block/qcow2-refcount.c
View File

@ -1020,8 +1020,7 @@ static void inc_refcounts(BlockDriverState *bs,
int64_t offset, int64_t size) int64_t offset, int64_t size)
{ {
BDRVQcowState *s = bs->opaque; BDRVQcowState *s = bs->opaque;
int64_t start, last, cluster_offset; uint64_t start, last, cluster_offset, k;
int k;
if (size <= 0) if (size <= 0)
return; return;
@ -1031,11 +1030,7 @@ static void inc_refcounts(BlockDriverState *bs,
for(cluster_offset = start; cluster_offset <= last; for(cluster_offset = start; cluster_offset <= last;
cluster_offset += s->cluster_size) { cluster_offset += s->cluster_size) {
k = cluster_offset >> s->cluster_bits; k = cluster_offset >> s->cluster_bits;
if (k < 0) { if (k >= refcount_table_size) {
fprintf(stderr, "ERROR: invalid cluster offset=0x%" PRIx64 "\n",
cluster_offset);
res->corruptions++;
} else if (k >= refcount_table_size) {
fprintf(stderr, "Warning: cluster offset=0x%" PRIx64 " is after " fprintf(stderr, "Warning: cluster offset=0x%" PRIx64 " is after "
"the end of the image file, can't properly check refcounts.\n", "the end of the image file, can't properly check refcounts.\n",
cluster_offset); cluster_offset);
@ -1478,14 +1473,19 @@ int qcow2_check_refcounts(BlockDriverState *bs, BdrvCheckResult *res,
BdrvCheckMode fix) BdrvCheckMode fix)
{ {
BDRVQcowState *s = bs->opaque; BDRVQcowState *s = bs->opaque;
int64_t size, i, highest_cluster; int64_t size, i, highest_cluster, nb_clusters;
int nb_clusters, refcount1, refcount2; int refcount1, refcount2;
QCowSnapshot *sn; QCowSnapshot *sn;
uint16_t *refcount_table; uint16_t *refcount_table;
int ret; int ret;
size = bdrv_getlength(bs->file); size = bdrv_getlength(bs->file);
nb_clusters = size_to_clusters(s, size); nb_clusters = size_to_clusters(s, size);
if (nb_clusters > INT_MAX) {
res->check_errors++;
return -EFBIG;
}
refcount_table = g_malloc0(nb_clusters * sizeof(uint16_t)); refcount_table = g_malloc0(nb_clusters * sizeof(uint16_t));
res->bfi.total_clusters = res->bfi.total_clusters =