From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:44479) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XhPEG-0006Xo-7B for qemu-devel@nongnu.org; Thu, 23 Oct 2014 16:43:35 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1XhPEB-0002ew-Ez for qemu-devel@nongnu.org; Thu, 23 Oct 2014 16:43:28 -0400 Received: from mx1.redhat.com ([209.132.183.28]:48572) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XhPEB-0002eQ-7z for qemu-devel@nongnu.org; Thu, 23 Oct 2014 16:43:23 -0400 Received: from int-mx09.intmail.prod.int.phx2.redhat.com (int-mx09.intmail.prod.int.phx2.redhat.com [10.5.11.22]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id s9NKhMkN001367 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=FAIL) for ; Thu, 23 Oct 2014 16:43:22 -0400 From: Kevin Wolf Date: Thu, 23 Oct 2014 22:42:36 +0200 Message-Id: <1414096959-14682-30-git-send-email-kwolf@redhat.com> In-Reply-To: <1414096959-14682-1-git-send-email-kwolf@redhat.com> References: <1414096959-14682-1-git-send-email-kwolf@redhat.com> Subject: [Qemu-devel] [PULL 29/32] qcow2: Do not overflow when writing an L1 sector List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: kwolf@redhat.com From: Max Reitz While writing an L1 table sector, qcow2_write_l1_entry() copies the respective range from s->l1_table to the local "buf" array. The size of s->l1_table does not have to be a multiple of L1_ENTRIES_PER_SECTOR; thus, limit the index which is used for copying all entries to the L1 size. Cc: qemu-stable@nongnu.org Signed-off-by: Max Reitz Reviewed-by: Peter Lieven Reviewed-by: Eric Blake Signed-off-by: Kevin Wolf --- block/qcow2-cluster.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/block/qcow2-cluster.c b/block/qcow2-cluster.c index f7dd8c0..4d888c7 100644 --- a/block/qcow2-cluster.c +++ b/block/qcow2-cluster.c @@ -164,12 +164,14 @@ static int l2_load(BlockDriverState *bs, uint64_t l2_offset, int qcow2_write_l1_entry(BlockDriverState *bs, int l1_index) { BDRVQcowState *s = bs->opaque; - uint64_t buf[L1_ENTRIES_PER_SECTOR]; + uint64_t buf[L1_ENTRIES_PER_SECTOR] = { 0 }; int l1_start_index; int i, ret; l1_start_index = l1_index & ~(L1_ENTRIES_PER_SECTOR - 1); - for (i = 0; i < L1_ENTRIES_PER_SECTOR; i++) { + for (i = 0; i < L1_ENTRIES_PER_SECTOR && l1_start_index + i < s->l1_size; + i++) + { buf[i] = cpu_to_be64(s->l1_table[l1_start_index + i]); } -- 1.8.3.1