[Qemu-devel] [PATCH] qed: limit to image size in qed_find_cluster()

[Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>]

Callers of bdrv_is_allocated() may go beyond the end of the image.  For
general robustness we should limit to the end of the image so that
callers don't end up using out-of-range sector counts and receive -EIO.

This fix will allow the image streaming to terminate successfully.

Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
---
 block/qed-cluster.c |    3 +++
 1 files changed, 3 insertions(+), 0 deletions(-)

diff --git a/block/qed-cluster.c b/block/qed-cluster.c
index f64b2af..4632b32 100644
--- a/block/qed-cluster.c
+++ b/block/qed-cluster.c
@@ -142,6 +142,9 @@ void qed_find_cluster(BDRVQEDState *s, QEDRequest *request, uint64_t pos,
      */
     len = MIN(len, (((pos >> s->l1_shift) + 1) << s->l1_shift) - pos);
 
+    /* Limit length to image size */
+    len = MIN(len, s->header.image_size - pos);
+
     l2_offset = s->l1_table->offsets[qed_l1_index(s, pos)];
     if (qed_offset_is_unalloc_cluster(l2_offset)) {
         cb(opaque, QED_CLUSTER_L1, 0, len);
-- 
1.7.7.3