From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:58818) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XbnJq-0003Up-R7 for qemu-devel@nongnu.org; Wed, 08 Oct 2014 05:14:08 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1XbnJl-0007U8-TU for qemu-devel@nongnu.org; Wed, 08 Oct 2014 05:14:02 -0400 Received: from mailhub.sw.ru ([195.214.232.25]:33078 helo=relay.sw.ru) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XbnJl-0007QZ-HE for qemu-devel@nongnu.org; Wed, 08 Oct 2014 05:13:57 -0400 From: "Denis V. Lunev" Date: Wed, 8 Oct 2014 13:13:30 +0400 Message-Id: <1412759610-2257-4-git-send-email-den@openvz.org> In-Reply-To: <1412759610-2257-1-git-send-email-den@openvz.org> References: <1412759610-2257-1-git-send-email-den@openvz.org> Subject: [Qemu-devel] [PATCH 3/3] block/parallels: fix access to not initialized memory in catalog_bitmap List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Kevin Wolf , "Denis V. Lunev" , Jeff Cody , qemu-devel@nongnu.org, Stefan Hajnoczi found by valgrind. Command: ./qemu-img convert -f parallels -O qcow2 1.hds 1.img Invalid read of size 4 at 0x17D0EF: parallels_co_read (parallels.c:357) by 0x11FEE4: bdrv_aio_rw_vector (block.c:4640) by 0x11FFBF: bdrv_aio_readv_em (block.c:4652) by 0x11F55F: bdrv_co_readv_em (block.c:4862) by 0x123428: bdrv_aligned_preadv (block.c:3056) by 0x1239FA: bdrv_co_do_preadv (block.c:3162) by 0x125424: bdrv_rw_co_entry (block.c:2706) by 0x155DD9: coroutine_trampoline (coroutine-ucontext.c:118) by 0x6975B6F: ??? (in /lib/x86_64-linux-gnu/libc-2.19.so) The problem is that s->catalog_bitmap is allocated/filled as gmalloc(s->catalog_size) thus index validity check must be inclusive, i.e. index >= s->catalog_size is invalid. Signed-off-by: Denis V. Lunev CC: Jeff Cody CC: Kevin Wolf CC: Stefan Hajnoczi --- block/parallels.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/block/parallels.c b/block/parallels.c index 2a814f3..4f9cd8d 100644 --- a/block/parallels.c +++ b/block/parallels.c @@ -155,7 +155,7 @@ static int64_t seek_to_sector(BlockDriverState *bs, int64_t sector_num) offset = sector_num % s->tracks; /* not allocated */ - if ((index > s->catalog_size) || (s->catalog_bitmap[index] == 0)) + if ((index >= s->catalog_size) || (s->catalog_bitmap[index] == 0)) return -1; return ((uint64_t)s->catalog_bitmap[index] * s->off_multiplier + offset) * 512; -- 1.9.1