[Qemu-devel] [7217] qcow2: Add plausibility check for L1/L2 entries (Kevin Wolf)

[Qemu-devel] [7217] qcow2: Add plausibility check for L1/L2 entries (Kevin Wolf)

[Anthony Liguori]

Revision: 7217
          http://svn.sv.gnu.org/viewvc/?view=rev&root=qemu&revision=7217
Author:   aliguori
Date:     2009-04-21 23:12:02 +0000 (Tue, 21 Apr 2009)
Log Message:
-----------
qcow2: Add plausibility check for L1/L2 entries (Kevin Wolf)

From: Kevin Wolf <kwolf@redhat.com>

All L1 and L2 entries must point at the start of a cluster. If there is some
offset into the cluster, the entry is corrupted.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

Modified Paths:
--------------
    trunk/block-qcow2.c

Modified: trunk/block-qcow2.c
===================================================================
--- trunk/block-qcow2.c	2009-04-21 23:11:58 UTC (rev 7216)
+++ trunk/block-qcow2.c	2009-04-21 23:12:02 UTC (rev 7217)
@@ -2666,6 +2666,13 @@
                 errors += inc_refcounts(bs, refcount_table,
                               refcount_table_size,
                               offset, s->cluster_size);
+
+                /* Correct offsets are cluster aligned */
+                if (offset & (s->cluster_size - 1)) {
+                    fprintf(stderr, "ERROR offset=%" PRIx64 ": Cluster is not "
+                        "properly aligned; L2 entry corrupted.\n", offset);
+                    errors++;
+                }
             }
         }
     }
@@ -2734,6 +2741,13 @@
                           l2_offset,
                           s->cluster_size);
 
+            /* L2 tables are cluster aligned */
+            if (l2_offset & (s->cluster_size - 1)) {
+                fprintf(stderr, "ERROR l2_offset=%" PRIx64 ": Table is not "
+                    "cluster aligned; L1 entry corrupted\n", l2_offset);
+                errors++;
+            }
+
             /* Process and check L2 entries */
             ret = check_refcounts_l2(bs, refcount_table, refcount_table_size,
                 l2_offset, check_copied);