From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:45101) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Vi3Bb-0004lH-Dr for qemu-devel@nongnu.org; Sun, 17 Nov 2013 09:18:57 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1Vi3BV-0005Y3-9A for qemu-devel@nongnu.org; Sun, 17 Nov 2013 09:18:51 -0500 Received: from mx1.redhat.com ([209.132.183.28]:51869) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Vi3BV-0005Xt-1r for qemu-devel@nongnu.org; Sun, 17 Nov 2013 09:18:45 -0500 Received: from int-mx12.intmail.prod.int.phx2.redhat.com (int-mx12.intmail.prod.int.phx2.redhat.com [10.5.11.25]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id rAHEIiDa004535 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Sun, 17 Nov 2013 09:18:44 -0500 From: Max Reitz Date: Sun, 17 Nov 2013 15:18:42 +0100 Message-Id: <1384697924-16918-3-git-send-email-mreitz@redhat.com> In-Reply-To: <1384697924-16918-1-git-send-email-mreitz@redhat.com> References: <1384697924-16918-1-git-send-email-mreitz@redhat.com> Subject: [Qemu-devel] [PATCH 2/4] qcow2-refcount: Sanitize refcount table size List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Kevin Wolf , Stefan Hajnoczi , Max Reitz Make sure the refcount table size will not overflow when multiplied by sizeof(uint64_t) and implicitly casted to int. Signed-off-by: Max Reitz --- block/qcow2-refcount.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/block/qcow2-refcount.c b/block/qcow2-refcount.c index 1ff43d0..2912097 100644 --- a/block/qcow2-refcount.c +++ b/block/qcow2-refcount.c @@ -42,6 +42,10 @@ int qcow2_refcount_init(BlockDriverState *bs) BDRVQcowState *s = bs->opaque; int ret, refcount_table_size2, i; + if (s->refcount_table_size >= INT_MAX / sizeof(uint64_t)) { + goto fail; + } + refcount_table_size2 = s->refcount_table_size * sizeof(uint64_t); s->refcount_table = g_malloc(refcount_table_size2); if (s->refcount_table_size > 0) { -- 1.8.4.2