From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:42973) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VUeIP-0007Bz-Iv for qemu-devel@nongnu.org; Fri, 11 Oct 2013 11:06:35 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1VUeIF-0005Ft-47 for qemu-devel@nongnu.org; Fri, 11 Oct 2013 11:06:29 -0400 Received: from mx1.redhat.com ([209.132.183.28]:15688) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VUeIE-0005Fh-SG for qemu-devel@nongnu.org; Fri, 11 Oct 2013 11:06:19 -0400 From: Kevin Wolf Date: Fri, 11 Oct 2013 17:05:05 +0200 Message-Id: <1381503951-27985-16-git-send-email-kwolf@redhat.com> In-Reply-To: <1381503951-27985-1-git-send-email-kwolf@redhat.com> References: <1381503951-27985-1-git-send-email-kwolf@redhat.com> Subject: [Qemu-devel] [PULL 15/61] qcow2: Assert against snapshot name/ID overflow List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: anthony@codemonkey.ws Cc: kwolf@redhat.com, qemu-devel@nongnu.org From: Max Reitz qcow2_write_snapshots relies on the length of every snapshot ID and name fitting into an unsigned 16 bit integer. This is currently ensured by QEMU through generally only allowing 128 byte IDs and 256 byte names. However, if this should change in the future, the length written to the image file should not be silently truncated (though the name itself would be written completely). Since this is currently not an issue but might require attention due to internal QEMU changes in the future, an assert ensuring sanity is enough for now. Signed-off-by: Max Reitz Signed-off-by: Kevin Wolf --- block/qcow2-snapshot.c | 1 + 1 file changed, 1 insertion(+) diff --git a/block/qcow2-snapshot.c b/block/qcow2-snapshot.c index f6f3e64..812dab2 100644 --- a/block/qcow2-snapshot.c +++ b/block/qcow2-snapshot.c @@ -221,6 +221,7 @@ static int qcow2_write_snapshots(BlockDriverState *bs) id_str_size = strlen(sn->id_str); name_size = strlen(sn->name); + assert(id_str_size <= UINT16_MAX && name_size <= UINT16_MAX); h.id_str_size = cpu_to_be16(id_str_size); h.name_size = cpu_to_be16(name_size); offset = align_offset(offset, 8); -- 1.8.1.4