From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:49617) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1W7H8O-0004dW-9b for qemu-devel@nongnu.org; Sat, 25 Jan 2014 23:15:52 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1W7H8J-0001IV-MG for qemu-devel@nongnu.org; Sat, 25 Jan 2014 23:15:48 -0500 Received: from paradis.irqsave.net ([62.212.105.220]:48344) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1W7H8J-0001HG-CE for qemu-devel@nongnu.org; Sat, 25 Jan 2014 23:15:43 -0500 Date: Sun, 26 Jan 2014 05:15:42 +0100 From: =?iso-8859-1?Q?Beno=EEt?= Canet Message-ID: <20140126041542.GB2958@irqsave.net> References: MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline In-Reply-To: Content-Transfer-Encoding: quoted-printable Subject: Re: [Qemu-devel] [PATCH v5 2/4] qcow2: fix offset overflow in qcow2_alloc_clusters_at() List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Hu Tao Cc: Kevin Wolf , =?iso-8859-1?Q?Beno=EEt?= Canet , qemu-devel@nongnu.org Le Sunday 26 Jan 2014 =E0 11:12:38 (+0800), Hu Tao a =E9crit : > When cluster size is big enough it can lead to an offset overflow > in qcow2_alloc_clusters_at(). This patch fixes it. >=20 > The allocation is stopped each time at L2 table boundary > (see handle_alloc()), so the possible maximum bytes could be >=20 > 2^(cluster_bits - 3 + cluster_bits) >=20 > cluster_bits - 3 is used to compute the number of entry by L2 > and the additional cluster_bits is to take into account each > clusters referenced by the L2 entries. >=20 > so int is safe for cluster_bits<=3D17, unsafe otherwise. >=20 > Reviewed-by: Max Reitz > Signed-off-by: Hu Tao > --- > block/qcow2-refcount.c | 8 +++++++- > 1 file changed, 7 insertions(+), 1 deletion(-) >=20 > diff --git a/block/qcow2-refcount.c b/block/qcow2-refcount.c > index c974abe..8712d8b 100644 > --- a/block/qcow2-refcount.c > +++ b/block/qcow2-refcount.c > @@ -676,7 +676,13 @@ int qcow2_alloc_clusters_at(BlockDriverState *bs, = uint64_t offset, > BDRVQcowState *s =3D bs->opaque; > uint64_t cluster_index; > uint64_t old_free_cluster_index; > - int i, refcount, ret; > + uint64_t i; > + int refcount, ret; > + > + assert(nb_clusters >=3D 0); > + if (nb_clusters =3D=3D 0) { > + return 0; > + } > =20 > /* Check how many clusters there are free */ > cluster_index =3D offset >> s->cluster_bits; > --=20 > 1.8.5.2.229.g4448466 >=20 Reviewed-by: Benoit Canet