summaryrefslogtreecommitdiff
path: root/block/qcow.c
diff options
context:
space:
mode:
authorJeff Cody <jcody@redhat.com>2015-01-22 08:03:30 -0500
committerKevin Wolf <kwolf@redhat.com>2015-01-23 18:17:06 +0100
commit9a29e18f7dfd5a0e80d1c60fc856ebba18ddb738 (patch)
treee9c2bf9ca98de347124834109e8bdee2b3859004 /block/qcow.c
parent1d33936ea847693a6d69f9049691a0341d6e0b9f (diff)
downloadqemu-9a29e18f7dfd5a0e80d1c60fc856ebba18ddb738.tar.gz
block: update string sizes for filename,backing_file,exact_filename
The string field entries 'filename', 'backing_file', and 'exact_filename' in the BlockDriverState struct are defined as 1024 bytes. However, many places that use these values accept a maximum of PATH_MAX bytes, so we have a mixture of 1024 byte and PATH_MAX byte allocations. This patch makes the BlockDriverStruct field string sizes match usage. This patch also does a few fixes related to the size that needs to happen now: * the block qapi driver is updated to use PATH_MAX bytes * the qcow and qcow2 drivers have an additional safety check * the block vvfat driver is updated to use PATH_MAX bytes for the size of backing_file, for systems where PATH_MAX is < 1024 bytes. * qemu-img uses PATH_MAX rather than 1024. These instances were not changed to be dynamically allocated, however, as the extra temporary 3K in stack usage for qemu-img does not seem worrisome. Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Signed-off-by: Jeff Cody <jcody@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Diffstat (limited to 'block/qcow.c')
-rw-r--r--block/qcow.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/block/qcow.c b/block/qcow.c
index ece22697a6..ccbe9e0d2c 100644
--- a/block/qcow.c
+++ b/block/qcow.c
@@ -215,7 +215,7 @@ static int qcow_open(BlockDriverState *bs, QDict *options, int flags,
/* read the backing file name */
if (header.backing_file_offset != 0) {
len = header.backing_file_size;
- if (len > 1023) {
+ if (len > 1023 || len > sizeof(bs->backing_file)) {
error_setg(errp, "Backing file name too long");
ret = -EINVAL;
goto fail;