diff options
| author | Kevin Wolf <kwolf@redhat.com> | 2012-10-26 16:33:32 +0200 |
|---|---|---|
| committer | Michael Roth <mdroth@linux.vnet.ibm.com> | 2012-12-03 13:32:32 -0600 |
| commit | 600a9efdb1ddb749332200cab27d9240fbc0bda1 (patch) | |
| tree | e3d623a5457c8f74c1f7d9c1725eec3055148b4c | |
| parent | ea79e157c61eb20e1065836f9d2719ffef91b8cf (diff) | |
| download | qemu-600a9efdb1ddb749332200cab27d9240fbc0bda1.tar.gz | |
qcow2: Fix refcount table size calculation
A missing factor for the refcount table entry size in the calculation
could mean that too little memory was allocated for the in-memory
representation of the table, resulting in a buffer overflow.
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Tested-by: Michael Tokarev <mjt@tls.msk.ru>
(cherry picked from commit a3548077062dd9dc2701ebffd931ba6eaef40bec)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
| -rw-r--r-- | block/qcow2-refcount.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/block/qcow2-refcount.c b/block/qcow2-refcount.c index 5e3f9153fb..96224d1af2 100644 --- a/block/qcow2-refcount.c +++ b/block/qcow2-refcount.c @@ -301,7 +301,8 @@ static int alloc_refcount_block(BlockDriverState *bs, uint64_t last_table_size; uint64_t blocks_clusters; do { - uint64_t table_clusters = size_to_clusters(s, table_size); + uint64_t table_clusters = + size_to_clusters(s, table_size * sizeof(uint64_t)); blocks_clusters = 1 + ((table_clusters + refcount_block_clusters - 1) / refcount_block_clusters); |