From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:44890) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YJlyO-0004xW-Sr for qemu-devel@nongnu.org; Fri, 06 Feb 2015 11:41:41 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1YJlyM-0000sA-3p for qemu-devel@nongnu.org; Fri, 06 Feb 2015 11:41:40 -0500 Received: from mx1.redhat.com ([209.132.183.28]:39412) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YJlyL-0000rr-Gb for qemu-devel@nongnu.org; Fri, 06 Feb 2015 11:41:37 -0500 Received: from int-mx13.intmail.prod.int.phx2.redhat.com (int-mx13.intmail.prod.int.phx2.redhat.com [10.5.11.26]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id t16GfaEP003688 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=FAIL) for ; Fri, 6 Feb 2015 11:41:37 -0500 From: Kevin Wolf Date: Fri, 6 Feb 2015 17:40:41 +0100 Message-Id: <1423240849-15499-35-git-send-email-kwolf@redhat.com> In-Reply-To: <1423240849-15499-1-git-send-email-kwolf@redhat.com> References: <1423240849-15499-1-git-send-email-kwolf@redhat.com> Subject: [Qemu-devel] [PULL 34/42] block: fix off-by-one error in qcow and qcow2 List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: kwolf@redhat.com From: Jeff Cody This fixes an off-by-one error introduced in 9a29e18. Both qcow and qcow2 need to make sure to leave room for string terminator '\0' for the backing file, so the max length of the non-terminated string is either 1023 or PATH_MAX - 1. Reported-by: Kevin Wolf Signed-off-by: Jeff Cody Signed-off-by: Kevin Wolf --- block/qcow.c | 2 +- block/qcow2.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/block/qcow.c b/block/qcow.c index ccbe9e0..0558969 100644 --- a/block/qcow.c +++ b/block/qcow.c @@ -215,7 +215,7 @@ static int qcow_open(BlockDriverState *bs, QDict *options, int flags, /* read the backing file name */ if (header.backing_file_offset != 0) { len = header.backing_file_size; - if (len > 1023 || len > sizeof(bs->backing_file)) { + if (len > 1023 || len >= sizeof(bs->backing_file)) { error_setg(errp, "Backing file name too long"); ret = -EINVAL; goto fail; diff --git a/block/qcow2.c b/block/qcow2.c index dbaf016..7e614d7 100644 --- a/block/qcow2.c +++ b/block/qcow2.c @@ -869,7 +869,7 @@ static int qcow2_open(BlockDriverState *bs, QDict *options, int flags, if (header.backing_file_offset != 0) { len = header.backing_file_size; if (len > MIN(1023, s->cluster_size - header.backing_file_offset) || - len > sizeof(bs->backing_file)) { + len >= sizeof(bs->backing_file)) { error_setg(errp, "Backing file name too long"); ret = -EINVAL; goto fail; -- 1.8.3.1