diff options
| author | Stefan Hajnoczi <stefanha@redhat.com> | 2014-03-26 13:05:29 +0100 |
|---|---|---|
| committer | Michael Roth <mdroth@linux.vnet.ibm.com> | 2014-07-03 16:18:10 -0500 |
| commit | dbd3e4a75cddbd99be51d1af5b26a5f3f6a134c2 (patch) | |
| tree | 3eab189a6a2f8866171a648efd061763d35d5ce1 /tests | |
| parent | 0fda3e2d639fee7c3262485c48c3b5fd6c9b4114 (diff) | |
| download | qemu-dbd3e4a75cddbd99be51d1af5b26a5f3f6a134c2.tar.gz | |
block/cloop: fix offsets[] size off-by-one
cloop stores the number of compressed blocks in the n_blocks header
field. The file actually contains n_blocks + 1 offsets, where the extra
offset is the end-of-file offset.
The following line in cloop_read_block() results in an out-of-bounds
offsets[] access:
uint32_t bytes = s->offsets[block_num + 1] - s->offsets[block_num];
This patch allocates and loads the extra offset so that
cloop_read_block() works correctly when the last block is accessed.
Notice that we must free s->offsets[] unconditionally now since there is
always an end-of-file offset.
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
(cherry picked from commit 42d43d35d907579179a39c924d169da924786f65)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Diffstat (limited to 'tests')
| -rwxr-xr-x | tests/qemu-iotests/075 | 5 | ||||
| -rw-r--r-- | tests/qemu-iotests/075.out | 4 |
2 files changed, 9 insertions, 0 deletions
diff --git a/tests/qemu-iotests/075 b/tests/qemu-iotests/075 index d74fb33272..40032c563d 100755 --- a/tests/qemu-iotests/075 +++ b/tests/qemu-iotests/075 @@ -52,6 +52,11 @@ _use_sample_img simple-pattern.cloop.bz2 $QEMU_IO -c "read 0 512" $TEST_IMG 2>&1 | _filter_qemu_io | _filter_testdir echo +echo "== check that the last sector can be read ==" +_use_sample_img simple-pattern.cloop.bz2 +$QEMU_IO -c "read $((1024 * 1024 - 512)) 512" $TEST_IMG 2>&1 | _filter_qemu_io | _filter_testdir + +echo echo "== block_size must be a multiple of 512 ==" _use_sample_img simple-pattern.cloop.bz2 poke_file "$TEST_IMG" "$block_size_offset" "\x00\x00\x02\x01" diff --git a/tests/qemu-iotests/075.out b/tests/qemu-iotests/075.out index 911cd3b4d8..5f1d6c120a 100644 --- a/tests/qemu-iotests/075.out +++ b/tests/qemu-iotests/075.out @@ -4,6 +4,10 @@ QA output created by 075 read 512/512 bytes at offset 0 512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) +== check that the last sector can be read == +read 512/512 bytes at offset 1048064 +512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) + == block_size must be a multiple of 512 == qemu-io: can't open device TEST_DIR/simple-pattern.cloop: block_size 513 must be a multiple of 512 no file open, try 'help open' |