All of lore.kernel.org
 help / color / mirror / Atom feed
From: Eduardo Habkost <ehabkost@raisama.net>
To: Stefan Weil <weil@mail.berlios.de>
Cc: qemu-devel <qemu-devel@nongnu.org>
Subject: Re: [Qemu-devel] [PATCH 1/4] vmdk: check for negative sector nums also
Date: Thu, 19 Feb 2009 18:56:41 -0300	[thread overview]
Message-ID: <1235080301-sup-7932@blackpad> (raw)
In-Reply-To: <499DD2C8.1050606@mail.berlios.de>

Excerpts from Stefan Weil's message of Qui Fev 19 18:44:40 -0300 2009:
> Eduardo Habkost schrieb:
> > Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
> > ---
> >  block-vmdk.c |    2 +-
> >  1 files changed, 1 insertions(+), 1 deletions(-)
> >
> > diff --git a/block-vmdk.c b/block-vmdk.c
> > index 71d7504..416fb95 100644
> > --- a/block-vmdk.c
> > +++ b/block-vmdk.c
> > @@ -649,7 +649,7 @@ static int vmdk_write(BlockDriverState *bs, int64_t sector_num,
> >   
> 
> Why is sector_num signed? An unsigned quantity would simplify the code below
> (no need to check for < 0).

It's part of the block device interface:

    int (*bdrv_write)(BlockDriverState *bs, int64_t sector_num,
                          const uint8_t *buf, int nb_sectors);

Changing it would require changing every other block driver. Shall we do
that?


> 
> >      uint64_t cluster_offset;
> >      static int cid_update = 0;
> >  
> > -    if (sector_num > bs->total_sectors) {
> > +    if (sector_num < 0 || sector_num > bs->total_sectors) {
> >          fprintf(stderr,
> >                  "(VMDK) Wrong offset: sector_num=0x%" PRIx64
> >                  " total_sectors=0x%" PRIx64 "\n",
> >   
> 
> Regards
> Stefan Weil
-- 
Eduardo

  reply	other threads:[~2009-02-19 21:57 UTC|newest]

Thread overview: 9+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2009-02-19 21:19 [Qemu-devel] [PATCH 0/4] CVE-2008-0928 security fix Eduardo Habkost
2009-02-19 21:19 ` [Qemu-devel] [PATCH 1/4] vmdk: check for negative sector nums also Eduardo Habkost
2009-02-19 21:44   ` Stefan Weil
2009-02-19 21:56     ` Eduardo Habkost [this message]
2009-02-19 21:19 ` [Qemu-devel] [PATCH 2/4] hw/sd.c: remove ununsed SECTOR_SIZE define Eduardo Habkost
2009-02-19 21:19 ` [Qemu-devel] [PATCH 3/4] Move SECTOR_BITS/SECTOR_SIZE to block.h Eduardo Habkost
2009-02-19 21:19 ` [Qemu-devel] [PATCH 4/4] Fix CVE-2008-0928 - insufficient block device address range checking Eduardo Habkost
2009-02-19 21:40   ` Eduardo Habkost
2009-02-19 22:21   ` Aurelien Jarno

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1235080301-sup-7932@blackpad \
    --to=ehabkost@raisama.net \
    --cc=qemu-devel@nongnu.org \
    --cc=weil@mail.berlios.de \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.