From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([140.186.70.92]:41361) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RNSQq-00022n-QX for qemu-devel@nongnu.org; Mon, 07 Nov 2011 11:52:26 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1RNSQm-0004pH-KA for qemu-devel@nongnu.org; Mon, 07 Nov 2011 11:52:24 -0500 Received: from mx1.redhat.com ([209.132.183.28]:8138) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RNSQm-0004p0-9F for qemu-devel@nongnu.org; Mon, 07 Nov 2011 11:52:20 -0500 From: Kevin Wolf Date: Mon, 7 Nov 2011 17:55:13 +0100 Message-Id: <1320684918-6483-7-git-send-email-kwolf@redhat.com> In-Reply-To: <1320684918-6483-1-git-send-email-kwolf@redhat.com> References: <1320684918-6483-1-git-send-email-kwolf@redhat.com> Subject: [Qemu-devel] [PATCH 06/11] vvfat: fix out of bounds array_get usage List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: anthony@codemonkey.ws Cc: kwolf@redhat.com, qemu-devel@nongnu.org From: Paolo Bonzini When reading the address of the first free entry, you cannot use array_get without first marking all entries as occupied. This is visible if you change the sectors per cluster on a floppy from 2 to 1. Signed-off-by: Paolo Bonzini Signed-off-by: Kevin Wolf --- block/vvfat.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/block/vvfat.c b/block/vvfat.c index e1fcdbc..75d0dc0 100644 --- a/block/vvfat.c +++ b/block/vvfat.c @@ -799,6 +799,7 @@ static int read_directory(BDRVVVFATState* s, int mapping_index) /* root directory */ int cur = s->directory.next; array_ensure_allocated(&(s->directory), ROOT_ENTRIES - 1); + s->directory.next = ROOT_ENTRIES; memset(array_get(&(s->directory), cur), 0, (ROOT_ENTRIES - cur) * sizeof(direntry_t)); } -- 1.7.6.4