From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:36627) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WO6M4-0005jH-Ay for qemu-devel@nongnu.org; Thu, 13 Mar 2014 10:11:34 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1WO6Ly-0006S5-CJ for qemu-devel@nongnu.org; Thu, 13 Mar 2014 10:11:28 -0400 Received: from mx1.redhat.com ([209.132.183.28]:47875) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WO6Ly-0006Rs-4K for qemu-devel@nongnu.org; Thu, 13 Mar 2014 10:11:22 -0400 From: Stefan Hajnoczi Date: Thu, 13 Mar 2014 15:10:45 +0100 Message-Id: <1394719868-24312-2-git-send-email-stefanha@redhat.com> In-Reply-To: <1394719868-24312-1-git-send-email-stefanha@redhat.com> References: <1394719868-24312-1-git-send-email-stefanha@redhat.com> Subject: [Qemu-devel] [PULL v2 for-2.0 01/24] qcow2-refcount: Sanitize refcount table entry List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Peter Maydell , Stefan Hajnoczi , Anthony Liguori , Max Reitz From: Max Reitz When reading the refcount table entry in get_refcount(), only bits which are actually significant for the refcount block offset should be taken into account. Signed-off-by: Max Reitz Reviewed-by: Laszlo Ersek Signed-off-by: Stefan Hajnoczi --- block/qcow2-refcount.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/block/qcow2-refcount.c b/block/qcow2-refcount.c index 8712d8b..6151148 100644 --- a/block/qcow2-refcount.c +++ b/block/qcow2-refcount.c @@ -96,7 +96,8 @@ static int get_refcount(BlockDriverState *bs, int64_t cluster_index) refcount_table_index = cluster_index >> (s->cluster_bits - REFCOUNT_SHIFT); if (refcount_table_index >= s->refcount_table_size) return 0; - refcount_block_offset = s->refcount_table[refcount_table_index]; + refcount_block_offset = + s->refcount_table[refcount_table_index] & REFT_OFFSET_MASK; if (!refcount_block_offset) return 0; -- 1.8.5.3