From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([2001:4830:134:3::10]:52262)
	by lists.gnu.org with esmtp (Exim 4.71) (envelope-from <pl@kamp.de>)
	id 1Xg6Nt-0007Is-Rq
	for qemu-devel@nongnu.org; Mon, 20 Oct 2014 02:24:06 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <pl@kamp.de>) id 1Xg6No-0008Kp-Ug
	for qemu-devel@nongnu.org; Mon, 20 Oct 2014 02:24:01 -0400
Received: from mx-v6.kamp.de ([2a02:248:0:51::16]:41185 helo=mx01.kamp.de)
	by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from <pl@kamp.de>)
	id 1Xg6No-0008Kj-KA
	for qemu-devel@nongnu.org; Mon, 20 Oct 2014 02:23:56 -0400
Message-ID: <5444AA76.9050402@kamp.de>
Date: Mon, 20 Oct 2014 08:23:50 +0200
From: Peter Lieven <pl@kamp.de>
MIME-Version: 1.0
References: <1413465957-20865-1-git-send-email-mreitz@redhat.com>
	<1413465957-20865-2-git-send-email-mreitz@redhat.com>
In-Reply-To: <1413465957-20865-2-git-send-email-mreitz@redhat.com>
Content-Type: text/plain; charset=windows-1252; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [Qemu-devel] [PATCH 1/2] qcow2: Do not overflow when writing an
	L1 sector
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: Max Reitz <mreitz@redhat.com>, qemu-devel@nongnu.org
Cc: Kevin Wolf <kwolf@redhat.com>, Stefan Hajnoczi <stefanha@redhat.com>

On 16.10.2014 15:25, Max Reitz wrote:
> While writing an L1 table sector, qcow2_write_l1_entry() copies the
> respective range from s->l1_table to the local "buf" array. The size of
> s->l1_table does not have to be a multiple of L1_ENTRIES_PER_SECTOR;
> thus, limit the index which is used for copying all entries to the L1
> size.
>
> Cc: qemu-stable@nongnu.org
> Signed-off-by: Max Reitz <mreitz@redhat.com>
> ---
>   block/qcow2-cluster.c | 6 ++++--
>   1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/block/qcow2-cluster.c b/block/qcow2-cluster.c
> index f7dd8c0..4d888c7 100644
> --- a/block/qcow2-cluster.c
> +++ b/block/qcow2-cluster.c
> @@ -164,12 +164,14 @@ static int l2_load(BlockDriverState *bs, uint64_t l2_offset,
>   int qcow2_write_l1_entry(BlockDriverState *bs, int l1_index)
>   {
>       BDRVQcowState *s = bs->opaque;
> -    uint64_t buf[L1_ENTRIES_PER_SECTOR];
> +    uint64_t buf[L1_ENTRIES_PER_SECTOR] = { 0 };
>       int l1_start_index;
>       int i, ret;
>   
>       l1_start_index = l1_index & ~(L1_ENTRIES_PER_SECTOR - 1);
> -    for (i = 0; i < L1_ENTRIES_PER_SECTOR; i++) {
> +    for (i = 0; i < L1_ENTRIES_PER_SECTOR && l1_start_index + i < s->l1_size;
> +         i++)
> +    {
>           buf[i] = cpu_to_be64(s->l1_table[l1_start_index + i]);
>       }
>   

Reviewed-by: Peter Lieven <pl@kamp.de>