diff options
| author | Max Reitz <mreitz@redhat.com> | 2014-10-16 15:25:56 +0200 |
|---|---|---|
| committer | Michael Roth <mdroth@linux.vnet.ibm.com> | 2015-01-06 18:12:17 -0600 |
| commit | 57248587af8090ca0bc7bd0cd672ff15e2ebf8b9 (patch) | |
| tree | a2a8eef327e988f24a141bee5cd61200ff2b3f71 | |
| parent | ff830f9d8822f27fce8863b952207b586037f6a5 (diff) | |
| download | qemu-57248587af8090ca0bc7bd0cd672ff15e2ebf8b9.tar.gz | |
qcow2: Do not overflow when writing an L1 sector
While writing an L1 table sector, qcow2_write_l1_entry() copies the
respective range from s->l1_table to the local "buf" array. The size of
s->l1_table does not have to be a multiple of L1_ENTRIES_PER_SECTOR;
thus, limit the index which is used for copying all entries to the L1
size.
Cc: qemu-stable@nongnu.org
Signed-off-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Peter Lieven <pl@kamp.de>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
(cherry picked from commit a1391444fe1cfef14976458f3293a2c6945e725c)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
| -rw-r--r-- | block/qcow2-cluster.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/block/qcow2-cluster.c b/block/qcow2-cluster.c index 4208dc08b5..26827a2746 100644 --- a/block/qcow2-cluster.c +++ b/block/qcow2-cluster.c @@ -158,12 +158,14 @@ static int l2_load(BlockDriverState *bs, uint64_t l2_offset, int qcow2_write_l1_entry(BlockDriverState *bs, int l1_index) { BDRVQcowState *s = bs->opaque; - uint64_t buf[L1_ENTRIES_PER_SECTOR]; + uint64_t buf[L1_ENTRIES_PER_SECTOR] = { 0 }; int l1_start_index; int i, ret; l1_start_index = l1_index & ~(L1_ENTRIES_PER_SECTOR - 1); - for (i = 0; i < L1_ENTRIES_PER_SECTOR; i++) { + for (i = 0; i < L1_ENTRIES_PER_SECTOR && l1_start_index + i < s->l1_size; + i++) + { buf[i] = cpu_to_be64(s->l1_table[l1_start_index + i]); } |