From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:38374) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VTpUI-0007Yg-J1 for qemu-devel@nongnu.org; Wed, 09 Oct 2013 04:51:28 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1VTpUC-0001ta-Kw for qemu-devel@nongnu.org; Wed, 09 Oct 2013 04:51:22 -0400 Received: from mx1.redhat.com ([209.132.183.28]:24117) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VTpUC-0001sf-Dx for qemu-devel@nongnu.org; Wed, 09 Oct 2013 04:51:16 -0400 Received: from int-mx10.intmail.prod.int.phx2.redhat.com (int-mx10.intmail.prod.int.phx2.redhat.com [10.5.11.23]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id r998pFMe004905 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Wed, 9 Oct 2013 04:51:15 -0400 From: Max Reitz Date: Wed, 9 Oct 2013 10:51:06 +0200 Message-Id: <1381308666-24268-4-git-send-email-mreitz@redhat.com> In-Reply-To: <1381308666-24268-1-git-send-email-mreitz@redhat.com> References: <1381308666-24268-1-git-send-email-mreitz@redhat.com> Subject: [Qemu-devel] [PATCH 3/3] qcow2: Assert against snapshot name/ID overflow List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Kevin Wolf , Stefan Hajnoczi , Max Reitz qcow2_write_snapshots relies on the length of every snapshot ID and name fitting into an unsigned 16 bit integer. This is currently ensured by QEMU through generally only allowing 128 byte IDs and 256 byte names. However, if this should change in the future, the length written to the image file should not be silently truncated (though the name itself would be written completely). Since this is currently not an issue but might require attention due to internal QEMU changes in the future, an assert ensuring sanity is enough for now. Signed-off-by: Max Reitz --- block/qcow2-snapshot.c | 1 + 1 file changed, 1 insertion(+) diff --git a/block/qcow2-snapshot.c b/block/qcow2-snapshot.c index f6f3e64..812dab2 100644 --- a/block/qcow2-snapshot.c +++ b/block/qcow2-snapshot.c @@ -221,6 +221,7 @@ static int qcow2_write_snapshots(BlockDriverState *bs) id_str_size = strlen(sn->id_str); name_size = strlen(sn->name); + assert(id_str_size <= UINT16_MAX && name_size <= UINT16_MAX); h.id_str_size = cpu_to_be16(id_str_size); h.name_size = cpu_to_be16(name_size); offset = align_offset(offset, 8); -- 1.8.3.1