From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:48490) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WM2yL-0007FE-S0 for qemu-devel@nongnu.org; Fri, 07 Mar 2014 17:10:35 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1WM2yE-0003cP-BA for qemu-devel@nongnu.org; Fri, 07 Mar 2014 17:10:29 -0500 Received: from mx1.redhat.com ([209.132.183.28]:17551) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WM2yE-0003ao-40 for qemu-devel@nongnu.org; Fri, 07 Mar 2014 17:10:22 -0500 Received: from int-mx12.intmail.prod.int.phx2.redhat.com (int-mx12.intmail.prod.int.phx2.redhat.com [10.5.11.25]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id s27MAFpx013103 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Fri, 7 Mar 2014 17:10:16 -0500 From: Max Reitz Date: Fri, 7 Mar 2014 23:10:12 +0100 Message-Id: <1394230212-19349-1-git-send-email-mreitz@redhat.com> Subject: [Qemu-devel] [PATCH] qcow2-refcount: Sanitize refcount table entry List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Kevin Wolf , Laszlo Ersek , Stefan Hajnoczi , Max Reitz When reading the refcount table entry in get_refcount(), only bits which are actually significant for the refcount block offset should be taken into account. Signed-off-by: Max Reitz --- block/qcow2-refcount.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/block/qcow2-refcount.c b/block/qcow2-refcount.c index 8712d8b..6151148 100644 --- a/block/qcow2-refcount.c +++ b/block/qcow2-refcount.c @@ -96,7 +96,8 @@ static int get_refcount(BlockDriverState *bs, int64_t cluster_index) refcount_table_index = cluster_index >> (s->cluster_bits - REFCOUNT_SHIFT); if (refcount_table_index >= s->refcount_table_size) return 0; - refcount_block_offset = s->refcount_table[refcount_table_index]; + refcount_block_offset = + s->refcount_table[refcount_table_index] & REFT_OFFSET_MASK; if (!refcount_block_offset) return 0; -- 1.9.0