From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43)
	id 1N6lzg-0007TC-5l
	for qemu-devel@nongnu.org; Sat, 07 Nov 2009 09:10:20 -0500
Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43)
	id 1N6lzd-0007SQ-MJ
	for qemu-devel@nongnu.org; Sat, 07 Nov 2009 09:10:18 -0500
Received: from [199.232.76.173] (port=51678 helo=monty-python.gnu.org)
	by lists.gnu.org with esmtp (Exim 4.43) id 1N6lzd-0007SN-JM
	for qemu-devel@nongnu.org; Sat, 07 Nov 2009 09:10:17 -0500
Received: from casper.infradead.org ([85.118.1.10]:32835)
	by monty-python.gnu.org with esmtps
	(TLS-1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.60) (envelope-from
	<BATV+63c00cb34a5466e156a1+2267+infradead.org+dwmw2@casper.srs.infradead.org>)
	id 1N6lzd-0007qz-7v
	for qemu-devel@nongnu.org; Sat, 07 Nov 2009 09:10:17 -0500
Received: from macbook.infradead.org ([2001:8b0:10b:1:216:eaff:fe05:bbb8])
	by casper.infradead.org with esmtpsa (Exim 4.69 #1 (Red Hat Linux))
	id 1N6lzY-0004Zk-Un
	for qemu-devel@nongnu.org; Sat, 07 Nov 2009 14:10:13 +0000
From: David Woodhouse <dwmw2@infradead.org>
Content-Type: text/plain; charset="UTF-8"
Date: Sat, 07 Nov 2009 14:10:01 +0000
Message-ID: <1257603001.30774.127.camel@macbook.infradead.org>
Mime-Version: 1.0
Content-Transfer-Encoding: 7bit
Subject: [Qemu-devel] [PATCH] Fix 32-bit overflow in parallels image support
List-Id: qemu-devel.nongnu.org
List-Unsubscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.gnu.org/pipermail/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: qemu-devel <qemu-devel@nongnu.org>

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

diff --git a/block/parallels.c b/block/parallels.c
index 0b64a5c..63b6738 100644
--- a/block/parallels.c
+++ b/block/parallels.c
@@ -119,7 +119,8 @@ fail:
 static inline int seek_to_sector(BlockDriverState *bs, int64_t sector_num)
 {
     BDRVParallelsState *s = bs->opaque;
-    uint32_t index, offset, position;
+    uint32_t index, offset;
+    uint64_t position;
 
     index = sector_num / s->tracks;
     offset = sector_num % s->tracks;
@@ -128,7 +129,7 @@ static inline int seek_to_sector(BlockDriverState *bs, int64_t sector_num)
     if ((index > s->catalog_size) || (s->catalog_bitmap[index] == 0))
 	return -1;
 
-    position = (s->catalog_bitmap[index] + offset) * 512;
+    position = (uint64_t)(s->catalog_bitmap[index] + offset) * 512;
 
 //    fprintf(stderr, "sector: %llx index=%x offset=%x pointer=%x position=%x\n",
 //	sector_num, index, offset, s->catalog_bitmap[index], position);


-- 
David Woodhouse                            Open Source Technology Centre
David.Woodhouse@intel.com                              Intel Corporation