From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:55070) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VPa9E-0006Uv-1S for qemu-devel@nongnu.org; Fri, 27 Sep 2013 11:40:08 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1VPa97-0007SG-AC for qemu-devel@nongnu.org; Fri, 27 Sep 2013 11:40:03 -0400 Received: from mx1.redhat.com ([209.132.183.28]:61215) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VPa97-0007S5-1E for qemu-devel@nongnu.org; Fri, 27 Sep 2013 11:39:57 -0400 From: Kevin Wolf Date: Fri, 27 Sep 2013 17:39:18 +0200 Message-Id: <1380296370-14523-19-git-send-email-kwolf@redhat.com> In-Reply-To: <1380296370-14523-1-git-send-email-kwolf@redhat.com> References: <1380296370-14523-1-git-send-email-kwolf@redhat.com> Subject: [Qemu-devel] [PULL 18/30] qcow2: Assert against currently impossible overflow List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: anthony@codemonkey.ws Cc: kwolf@redhat.com, qemu-devel@nongnu.org From: Max Reitz If qcow2_alloc_cluster_link_l2 is called with a QCowL2Meta describing a request crossing L2 boundaries, a buffer overflow will occur. This is impossible right now since such requests are never generated (every request is shortened to L2 boundaries before) and probably also completely unintended (considering the name "QCowL2Meta"), however, it is still worth an assertion. Signed-off-by: Max Reitz Signed-off-by: Kevin Wolf --- block/qcow2-cluster.c | 1 + 1 file changed, 1 insertion(+) diff --git a/block/qcow2-cluster.c b/block/qcow2-cluster.c index 738ff73..cab5f2e 100644 --- a/block/qcow2-cluster.c +++ b/block/qcow2-cluster.c @@ -716,6 +716,7 @@ int qcow2_alloc_cluster_link_l2(BlockDriverState *bs, QCowL2Meta *m) } qcow2_cache_entry_mark_dirty(s->l2_table_cache, l2_table); + assert(l2_index + m->nb_clusters <= s->l2_size); for (i = 0; i < m->nb_clusters; i++) { /* if two concurrent writes happen to the same unallocated cluster * each write allocates separate cluster and writes data concurrently. -- 1.8.1.4