block/cloop: fix offsets[] size off-by-one
cloop stores the number of compressed blocks in the n_blocks header field. The file actually contains n_blocks + 1 offsets, where the extra offset is the end-of-file offset. The following line in cloop_read_block() results in an out-of-bounds offsets[] access: uint32_t bytes = s->offsets[block_num + 1] - s->offsets[block_num]; This patch allocates and loads the extra offset so that cloop_read_block() works correctly when the last block is accessed. Notice that we must free s->offsets[] unconditionally now since there is always an end-of-file offset. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
This commit is contained in:
parent
f56b9bc3ae
commit
42d43d35d9
@ -99,14 +99,14 @@ static int cloop_open(BlockDriverState *bs, QDict *options, int flags,
|
||||
s->n_blocks = be32_to_cpu(s->n_blocks);
|
||||
|
||||
/* read offsets */
|
||||
if (s->n_blocks > UINT32_MAX / sizeof(uint64_t)) {
|
||||
if (s->n_blocks > (UINT32_MAX - 1) / sizeof(uint64_t)) {
|
||||
/* Prevent integer overflow */
|
||||
error_setg(errp, "n_blocks %u must be %zu or less",
|
||||
s->n_blocks,
|
||||
UINT32_MAX / sizeof(uint64_t));
|
||||
(UINT32_MAX - 1) / sizeof(uint64_t));
|
||||
return -EINVAL;
|
||||
}
|
||||
offsets_size = s->n_blocks * sizeof(uint64_t);
|
||||
offsets_size = (s->n_blocks + 1) * sizeof(uint64_t);
|
||||
if (offsets_size > 512 * 1024 * 1024) {
|
||||
/* Prevent ridiculous offsets_size which causes memory allocation to
|
||||
* fail or overflows bdrv_pread() size. In practice the 512 MB
|
||||
@ -123,7 +123,7 @@ static int cloop_open(BlockDriverState *bs, QDict *options, int flags,
|
||||
goto fail;
|
||||
}
|
||||
|
||||
for(i=0;i<s->n_blocks;i++) {
|
||||
for (i = 0; i < s->n_blocks + 1; i++) {
|
||||
uint64_t size;
|
||||
|
||||
s->offsets[i] = be64_to_cpu(s->offsets[i]);
|
||||
@ -243,9 +243,7 @@ static coroutine_fn int cloop_co_read(BlockDriverState *bs, int64_t sector_num,
|
||||
static void cloop_close(BlockDriverState *bs)
|
||||
{
|
||||
BDRVCloopState *s = bs->opaque;
|
||||
if (s->n_blocks > 0) {
|
||||
g_free(s->offsets);
|
||||
}
|
||||
g_free(s->offsets);
|
||||
g_free(s->compressed_block);
|
||||
g_free(s->uncompressed_block);
|
||||
inflateEnd(&s->zstream);
|
||||
|
@ -51,6 +51,11 @@ echo "== check that the first sector can be read =="
|
||||
_use_sample_img simple-pattern.cloop.bz2
|
||||
$QEMU_IO -c "read 0 512" $TEST_IMG 2>&1 | _filter_qemu_io | _filter_testdir
|
||||
|
||||
echo
|
||||
echo "== check that the last sector can be read =="
|
||||
_use_sample_img simple-pattern.cloop.bz2
|
||||
$QEMU_IO -c "read $((1024 * 1024 - 512)) 512" $TEST_IMG 2>&1 | _filter_qemu_io | _filter_testdir
|
||||
|
||||
echo
|
||||
echo "== block_size must be a multiple of 512 =="
|
||||
_use_sample_img simple-pattern.cloop.bz2
|
||||
|
@ -4,6 +4,10 @@ QA output created by 075
|
||||
read 512/512 bytes at offset 0
|
||||
512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
|
||||
|
||||
== check that the last sector can be read ==
|
||||
read 512/512 bytes at offset 1048064
|
||||
512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
|
||||
|
||||
== block_size must be a multiple of 512 ==
|
||||
qemu-io: can't open device TEST_DIR/simple-pattern.cloop: block_size 513 must be a multiple of 512
|
||||
no file open, try 'help open'
|
||||
|
Loading…
Reference in New Issue
Block a user