From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1M2PV9-0003MY-Br for qemu-devel@nongnu.org; Fri, 08 May 2009 08:48:31 -0400 Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43) id 1M2PV4-0003Ao-FY for qemu-devel@nongnu.org; Fri, 08 May 2009 08:48:30 -0400 Received: from [199.232.76.173] (port=56994 helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1M2PV4-0003AU-B5 for qemu-devel@nongnu.org; Fri, 08 May 2009 08:48:26 -0400 Received: from mx2.redhat.com ([66.187.237.31]:53815) by monty-python.gnu.org with esmtp (Exim 4.60) (envelope-from ) id 1M2PV3-0005Sq-Qo for qemu-devel@nongnu.org; Fri, 08 May 2009 08:48:26 -0400 Received: from int-mx2.corp.redhat.com (int-mx2.corp.redhat.com [172.16.27.26]) by mx2.redhat.com (8.13.8/8.13.8) with ESMTP id n48CmOvn032145 for ; Fri, 8 May 2009 08:48:24 -0400 From: Kevin Wolf Date: Fri, 8 May 2009 14:47:24 +0200 Message-Id: <1241786844-1946-1-git-send-email-kwolf@redhat.com> Subject: [Qemu-devel] [PATCH] Improve block range checks List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Kevin Wolf This patch makes the range checks for block requests more strict: It fixes a potential integer overflow and checks for negative offsets. Also, it adds the check for compressed writes. Signed-off-by: Kevin Wolf --- block.c | 7 ++++++- 1 files changed, 6 insertions(+), 1 deletions(-) diff --git a/block.c b/block.c index 3d1223d..acb8976 100644 --- a/block.c +++ b/block.c @@ -578,7 +578,10 @@ static int bdrv_check_byte_request(BlockDriverState *bs, int64_t offset, len = bdrv_getlength(bs); - if ((offset + size) > len) + if (offset < 0) + return -EIO; + + if ((offset > len) || (len - offset < size)) return -EIO; return 0; @@ -1150,6 +1153,8 @@ int bdrv_write_compressed(BlockDriverState *bs, int64_t sector_num, return -ENOMEDIUM; if (!drv->bdrv_write_compressed) return -ENOTSUP; + if (bdrv_check_request(bs, sector_num, nb_sectors)) + return -EIO; return drv->bdrv_write_compressed(bs, sector_num, buf, nb_sectors); } -- 1.6.0.6