[Qemu-devel] [PATCH v2] block/vvfat: Fix crash when reporting error about too many files in directory

[Qemu-devel] [PATCH v2] block/vvfat: Fix crash when reporting error about too many files in directory

[Thomas Huth]

When using the vvfat driver with a directory that contains too many files,
QEMU currently crashes. This can be triggered like this for example:

 mkdir /tmp/vvfattest
 cd /tmp/vvfattest
 for ((x=0;x<=513;x++)); do mkdir $x; done
 qemu-system-x86_64 -drive \
   file.driver=vvfat,file.dir=.,read-only=on,media=cdrom

Seems like read_directory() is changing the mapping->path variable. Make
sure we use the right pointer instead.

Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 block/vvfat.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/block/vvfat.c b/block/vvfat.c
index fc41841..f2e7d50 100644
--- a/block/vvfat.c
+++ b/block/vvfat.c
@@ -973,10 +973,10 @@ static int init_directories(BDRVVVFATState* s,
         mapping = array_get(&(s->mapping), i);
 
         if (mapping->mode & MODE_DIRECTORY) {
+            char *path = mapping->path;
             mapping->begin = cluster;
             if(read_directory(s, i)) {
-                error_setg(errp, "Could not read directory %s",
-                           mapping->path);
+                error_setg(errp, "Could not read directory %s", path);
                 return -1;
             }
             mapping = array_get(&(s->mapping), i);
-- 
1.8.3.1

Re: [Qemu-devel] [PATCH v2] block/vvfat: Fix crash when reporting error about too many files in directory

[Thomas Huth]

On 2018-07-24 13:52, Thomas Huth wrote:
> When using the vvfat driver with a directory that contains too many files,
> QEMU currently crashes. This can be triggered like this for example:
> 
>  mkdir /tmp/vvfattest
>  cd /tmp/vvfattest
>  for ((x=0;x<=513;x++)); do mkdir $x; done
>  qemu-system-x86_64 -drive \
>    file.driver=vvfat,file.dir=.,read-only=on,media=cdrom
> 
> Seems like read_directory() is changing the mapping->path variable. Make
> sure we use the right pointer instead.
> 
> Signed-off-by: Thomas Huth <thuth@redhat.com>
> ---
>  block/vvfat.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/block/vvfat.c b/block/vvfat.c
> index fc41841..f2e7d50 100644
> --- a/block/vvfat.c
> +++ b/block/vvfat.c
> @@ -973,10 +973,10 @@ static int init_directories(BDRVVVFATState* s,
>          mapping = array_get(&(s->mapping), i);
>  
>          if (mapping->mode & MODE_DIRECTORY) {
> +            char *path = mapping->path;
>              mapping->begin = cluster;
>              if(read_directory(s, i)) {
> -                error_setg(errp, "Could not read directory %s",
> -                           mapping->path);
> +                error_setg(errp, "Could not read directory %s", path);
>                  return -1;
>              }
>              mapping = array_get(&(s->mapping), i);
> 

Ping?

Re: [Qemu-devel] [PATCH v2] block/vvfat: Fix crash when reporting error about too many files in directory

[Kevin Wolf]

Am 24.07.2018 um 13:52 hat Thomas Huth geschrieben:
> When using the vvfat driver with a directory that contains too many files,
> QEMU currently crashes. This can be triggered like this for example:
> 
>  mkdir /tmp/vvfattest
>  cd /tmp/vvfattest
>  for ((x=0;x<=513;x++)); do mkdir $x; done
>  qemu-system-x86_64 -drive \
>    file.driver=vvfat,file.dir=.,read-only=on,media=cdrom
> 
> Seems like read_directory() is changing the mapping->path variable. Make
> sure we use the right pointer instead.
> 
> Signed-off-by: Thomas Huth <thuth@redhat.com>

Thanks, applied to the block branch.

Kevin