From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([140.186.70.92]:60227) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RV3ud-0002Cc-2C for qemu-devel@nongnu.org; Mon, 28 Nov 2011 11:18:40 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1RV3uX-0004P1-9F for qemu-devel@nongnu.org; Mon, 28 Nov 2011 11:18:35 -0500 Received: from e06smtp16.uk.ibm.com ([195.75.94.112]:42737) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RV3uW-0004Oa-Uw for qemu-devel@nongnu.org; Mon, 28 Nov 2011 11:18:29 -0500 Received: from /spool/local by e06smtp16.uk.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Mon, 28 Nov 2011 16:18:27 -0000 Received: from d06av03.portsmouth.uk.ibm.com (d06av03.portsmouth.uk.ibm.com [9.149.37.213]) by d06nrmr1806.portsmouth.uk.ibm.com (8.13.8/8.13.8/NCO v10.0) with ESMTP id pASGIP7U2666670 for ; Mon, 28 Nov 2011 16:18:25 GMT Received: from d06av03.portsmouth.uk.ibm.com (localhost.localdomain [127.0.0.1]) by d06av03.portsmouth.uk.ibm.com (8.14.4/8.13.1/NCO v10.0 AVout) with ESMTP id pASGIPdM025643 for ; Mon, 28 Nov 2011 09:18:25 -0700 From: Stefan Hajnoczi Date: Mon, 28 Nov 2011 16:18:20 +0000 Message-Id: <1322497100-24167-1-git-send-email-stefanha@linux.vnet.ibm.com> Subject: [Qemu-devel] [PATCH] qed: limit to image size in qed_find_cluster() List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Kevin Wolf , Stefan Hajnoczi Callers of bdrv_is_allocated() may go beyond the end of the image. For general robustness we should limit to the end of the image so that callers don't end up using out-of-range sector counts and receive -EIO. This fix will allow the image streaming to terminate successfully. Signed-off-by: Stefan Hajnoczi --- block/qed-cluster.c | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) diff --git a/block/qed-cluster.c b/block/qed-cluster.c index f64b2af..4632b32 100644 --- a/block/qed-cluster.c +++ b/block/qed-cluster.c @@ -142,6 +142,9 @@ void qed_find_cluster(BDRVQEDState *s, QEDRequest *request, uint64_t pos, */ len = MIN(len, (((pos >> s->l1_shift) + 1) << s->l1_shift) - pos); + /* Limit length to image size */ + len = MIN(len, s->header.image_size - pos); + l2_offset = s->l1_table->offsets[qed_l1_index(s, pos)]; if (qed_offset_is_unalloc_cluster(l2_offset)) { cb(opaque, QED_CLUSTER_L1, 0, len); -- 1.7.7.3