From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:41444) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VOrKr-00062h-J3 for qemu-devel@nongnu.org; Wed, 25 Sep 2013 11:49:11 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1VOrKl-00057n-DI for qemu-devel@nongnu.org; Wed, 25 Sep 2013 11:49:05 -0400 Received: from mx1.redhat.com ([209.132.183.28]:52314) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VOrKl-00057V-4L for qemu-devel@nongnu.org; Wed, 25 Sep 2013 11:48:59 -0400 Received: from int-mx02.intmail.prod.int.phx2.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id r8PFmvxN008841 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Wed, 25 Sep 2013 11:48:58 -0400 From: Max Reitz Date: Wed, 25 Sep 2013 17:48:55 +0200 Message-Id: <1380124135-21008-1-git-send-email-mreitz@redhat.com> Subject: [Qemu-devel] [PATCH] qcow2: Assert against currently impossible overflow List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Kevin Wolf , Stefan Hajnoczi , Max Reitz If qcow2_alloc_cluster_link_l2 is called with a QCowL2Meta describing a request crossing L2 boundaries, a buffer overflow will occur. This is impossible right now since such requests are never generated (every request is shortened to L2 boundaries before) and probably also completely unintended (considering the name "QCowL2Meta"), however, it is still worth an assertion. Signed-off-by: Max Reitz --- block/qcow2-cluster.c | 1 + 1 file changed, 1 insertion(+) diff --git a/block/qcow2-cluster.c b/block/qcow2-cluster.c index 738ff73..cab5f2e 100644 --- a/block/qcow2-cluster.c +++ b/block/qcow2-cluster.c @@ -716,6 +716,7 @@ int qcow2_alloc_cluster_link_l2(BlockDriverState *bs, QCowL2Meta *m) } qcow2_cache_entry_mark_dirty(s->l2_table_cache, l2_table); + assert(l2_index + m->nb_clusters <= s->l2_size); for (i = 0; i < m->nb_clusters; i++) { /* if two concurrent writes happen to the same unallocated cluster * each write allocates separate cluster and writes data concurrently. -- 1.8.3.1