From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:38452) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1W6Nql-0003D8-TY for qemu-devel@nongnu.org; Thu, 23 Jan 2014 12:14:00 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1W6Nqg-0001Ed-QD for qemu-devel@nongnu.org; Thu, 23 Jan 2014 12:13:55 -0500 Received: from paradis.irqsave.net ([62.212.105.220]:48152) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1W6Nqg-0001CT-Fv for qemu-devel@nongnu.org; Thu, 23 Jan 2014 12:13:50 -0500 Date: Thu, 23 Jan 2014 18:13:48 +0100 From: =?iso-8859-1?Q?Beno=EEt?= Canet Message-ID: <20140123171348.GD3519@irqsave.net> References: MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline In-Reply-To: Content-Transfer-Encoding: quoted-printable Subject: Re: [Qemu-devel] [PATCH v4 2/4] qcow2: fix offset overflow in qcow2_alloc_clusters_at() List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Hu Tao Cc: Kevin Wolf , qemu-devel@nongnu.org Le Thursday 23 Jan 2014 =E0 11:04:06 (+0800), Hu Tao a =E9crit : > When cluster size is big enough it can lead offset overflow Maybe "it can lead to an offset overflow in" > in qcow2_alloc_clusters_at(). This patch fixes it. >=20 > The allocation each time is stopped at L2 table boundary "The allocation is stopped each time at" > (see handle_alloc()), so the possible maximum bytes could be >=20 > 2^(cluster_bits - 3 + cluster_bits) So if understand cluster_bits - 3 is used to compute the number of entry = by L2 and the additional cluster_bits is to take into account each clusters ref= erenced by the L2 entries. It makes sense. >=20 > so int is safe for cluster_bits<=3D17, unsafe otherwise. >=20 > Reviewed-by: Max Reitz > Signed-off-by: Hu Tao > --- > block/qcow2-refcount.c | 8 +++++++- > 1 file changed, 7 insertions(+), 1 deletion(-) >=20 > diff --git a/block/qcow2-refcount.c b/block/qcow2-refcount.c > index c974abe..8712d8b 100644 > --- a/block/qcow2-refcount.c > +++ b/block/qcow2-refcount.c > @@ -676,7 +676,13 @@ int qcow2_alloc_clusters_at(BlockDriverState *bs, = uint64_t offset, > BDRVQcowState *s =3D bs->opaque; > uint64_t cluster_index; > uint64_t old_free_cluster_index; > - int i, refcount, ret; > + uint64_t i; > + int refcount, ret; > + > + assert(nb_clusters >=3D 0); > + if (nb_clusters =3D=3D 0) { > + return 0; > + } ^ Adding a a line on the commit message about this assertion and chunk of c= ode would be helpful. Best regards Beno=EEt > =20 > /* Check how many clusters there are free */ > cluster_index =3D offset >> s->cluster_bits; > --=20 > 1.8.5.2.229.g4448466 >=20 >=20