From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:39756) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1X35pd-0000dA-GL for qemu-devel@nongnu.org; Fri, 04 Jul 2014 11:55:31 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1X35pP-0005wP-NP for qemu-devel@nongnu.org; Fri, 04 Jul 2014 11:55:25 -0400 Received: from mx1.redhat.com ([209.132.183.28]:33400) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1X35pP-0005wH-F8 for qemu-devel@nongnu.org; Fri, 04 Jul 2014 11:55:11 -0400 Received: from int-mx09.intmail.prod.int.phx2.redhat.com (int-mx09.intmail.prod.int.phx2.redhat.com [10.5.11.22]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id s64FtAQg004721 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Fri, 4 Jul 2014 11:55:10 -0400 From: Kevin Wolf Date: Fri, 4 Jul 2014 17:55:02 +0200 Message-Id: <1404489305-8750-2-git-send-email-kwolf@redhat.com> In-Reply-To: <1404489305-8750-1-git-send-email-kwolf@redhat.com> References: <1404489305-8750-1-git-send-email-kwolf@redhat.com> Subject: [Qemu-devel] [PATCH 1/4] block: Make qiov match the request size until EOF List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: kwolf@redhat.com, stefanha@redhat.com If a read request goes across EOF, the block driver sees a shortened request that stops at EOF (the rest is memsetted in block.c), however the original qiov was used for this request. This patch makes the qiov size match the request size, avoiding a potential buffer overflow in raw-posix. Signed-off-by: Kevin Wolf --- block.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/block.c b/block.c index 159a31e..ac4a037 100644 --- a/block.c +++ b/block.c @@ -3060,8 +3060,17 @@ static int coroutine_fn bdrv_aligned_preadv(BlockDriverState *bs, max_nb_sectors = ROUND_UP(MAX(0, total_sectors - sector_num), align >> BDRV_SECTOR_BITS); if (max_nb_sectors > 0) { + QEMUIOVector local_qiov; + + qemu_iovec_init(&local_qiov, qiov->niov); + qemu_iovec_concat(&local_qiov, qiov, 0, + max_nb_sectors * BDRV_SECTOR_SIZE); + ret = drv->bdrv_co_readv(bs, sector_num, - MIN(nb_sectors, max_nb_sectors), qiov); + MIN(nb_sectors, max_nb_sectors), + &local_qiov); + + qemu_iovec_destroy(&local_qiov); } else { ret = 0; } -- 1.8.3.1