[Qemu-devel] Segementation fault running qemu-img commit

[Qemu-devel] Segementation fault running qemu-img commit

[Ryan Rempel]

[-- Attachment #1: Type: text/plain, Size: 603 bytes --]

I was getting a segmentation fault when running "qemu-img commit" (to
commit changes back to the underlying filesystem).

It appears that the problem is that there is code in block-cow.c that
"reads ahead" in a bitmap without checking whether it is falling off
the end of the bitmap. At least in my case (running on FreeBSD 5) this
ends up causing a segmentation fault.

I've attached a patch which appears to fix the problem (I'm not sure
if it is the most elegant fix). I've tried to avoid an "off-by-one"
problem in the patch, but you should probably review it to make sure
I've got the logic right.

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: patch-block-cow.c --]
[-- Type: text/x-csrc; name="patch-block-cow.c", Size: 782 bytes --]

--- qemu/block-cow.c.orig	Tue Mar 29 12:12:18 2005
+++ qemu/block-cow.c	Tue Mar 29 12:30:25 2005
@@ -162,6 +162,9 @@
                             int nb_sectors, int *pnum)
 {
     BDRVCowState *s = bs->opaque;
+    if (s->cow_bitmap_size <= (sector_num + nb_sectors) / 8) {
+        nb_sectors = (((int64_t) s->cow_bitmap_size) * 8) - sector_num; 
+    }
     return is_changed(s->cow_bitmap, sector_num, nb_sectors, pnum);
 }
 
@@ -170,6 +173,10 @@
 {
     BDRVCowState *s = bs->opaque;
     int ret, n;
+
+    if (s->cow_bitmap_size <= (sector_num + nb_sectors) / 8) {
+        nb_sectors = (((int64_t) s->cow_bitmap_size) * 8) - sector_num; 
+    }
     
     while (nb_sectors > 0) {
         if (is_changed(s->cow_bitmap, sector_num, nb_sectors, &n)) {