From 40d0209bd663492d87e3c9869fbe91140ec3911c Mon Sep 17 00:00:00 2001 Message-Id: <40d0209bd663492d87e3c9869fbe91140ec3911c.1429902956.git.jen@redhat.com> In-Reply-To: <67968bc615637394c3ef7dfefa360dab90f33d5d.1429902956.git.jen@redhat.com> References: <67968bc615637394c3ef7dfefa360dab90f33d5d.1429902956.git.jen@redhat.com> From: Max Reitz Date: Wed, 18 Mar 2015 19:22:01 -0500 Subject: [CHANGE 18/42] qcow2: Do not overflow when writing an L1 sector To: rhvirt-patches@redhat.com, jen@redhat.com RH-Author: Max Reitz Message-id: <1426706542-30384-19-git-send-email-mreitz@redhat.com> Patchwork-id: 64482 O-Subject: [RHEL-6.7 qemu-kvm PATCH v2 18/39] qcow2: Do not overflow when writing an L1 sector Bugzilla: 1129892 RH-Acked-by: Jeffrey Cody RH-Acked-by: Kevin Wolf RH-Acked-by: Stefan Hajnoczi BZ: 1129892 While writing an L1 table sector, qcow2_write_l1_entry() copies the respective range from s->l1_table to the local "buf" array. The size of s->l1_table does not have to be a multiple of L1_ENTRIES_PER_SECTOR; thus, limit the index which is used for copying all entries to the L1 size. Cc: qemu-stable@nongnu.org Signed-off-by: Max Reitz Reviewed-by: Peter Lieven Reviewed-by: Eric Blake Signed-off-by: Kevin Wolf (cherry picked from commit a1391444fe1cfef14976458f3293a2c6945e725c) Signed-off-by: Max Reitz --- block/qcow2-cluster.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) Signed-off-by: Jeff E. Nelson --- block/qcow2-cluster.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/block/qcow2-cluster.c b/block/qcow2-cluster.c index 111908a..780cc83 100644 --- a/block/qcow2-cluster.c +++ b/block/qcow2-cluster.c @@ -141,12 +141,14 @@ static int l2_load(BlockDriverState *bs, uint64_t l2_offset, int qcow2_write_l1_entry(BlockDriverState *bs, int l1_index) { BDRVQcowState *s = bs->opaque; - uint64_t buf[L1_ENTRIES_PER_SECTOR]; + uint64_t buf[L1_ENTRIES_PER_SECTOR] = { 0 }; int l1_start_index; int i, ret; l1_start_index = l1_index & ~(L1_ENTRIES_PER_SECTOR - 1); - for (i = 0; i < L1_ENTRIES_PER_SECTOR; i++) { + for (i = 0; i < L1_ENTRIES_PER_SECTOR && l1_start_index + i < s->l1_size; + i++) + { buf[i] = cpu_to_be64(s->l1_table[l1_start_index + i]); } -- 2.1.0