[Qemu-devel] [PATCH 5/5] qcow2: Add plausibility check for L1/L2 entries

[kwolf@redhat.com]

From: Kevin Wolf <kwolf@redhat.com>

All L1 and L2 entries must point at the start of a cluster. If there is some
offset into the cluster, the entry is corrupted.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block-qcow2.c |   14 ++++++++++++++
 1 files changed, 14 insertions(+), 0 deletions(-)

diff --git a/block-qcow2.c b/block-qcow2.c
index 2e91e6e..25c1d23 100644
--- a/block-qcow2.c
+++ b/block-qcow2.c
@@ -2666,6 +2666,13 @@ static int check_refcounts_l2(BlockDriverState *bs,
                 errors += inc_refcounts(bs, refcount_table,
                               refcount_table_size,
                               offset, s->cluster_size);
+
+                /* Correct offsets are cluster aligned */
+                if (offset & (s->cluster_size - 1)) {
+                    fprintf(stderr, "ERROR offset=%" PRIx64 ": Cluster is not "
+                        "properly aligned; L2 entry corrupted.\n", offset);
+                    errors++;
+                }
             }
         }
     }
@@ -2734,6 +2741,13 @@ static int check_refcounts_l1(BlockDriverState *bs,
                           l2_offset,
                           s->cluster_size);
 
+            /* L2 tables are cluster aligned */
+            if (l2_offset & (s->cluster_size - 1)) {
+                fprintf(stderr, "ERROR l2_offset=%" PRIx64 ": Table is not "
+                    "cluster aligned; L1 entry corrupted\n", l2_offset);
+                errors++;
+            }
+
             /* Process and check L2 entries */
             ret = check_refcounts_l2(bs, refcount_table, refcount_table_size,
                 l2_offset, check_copied);
-- 
1.6.0.6