diff options
| -rw-r--r-- | block/qcow.c | 8 | ||||
| -rwxr-xr-x | tests/qemu-iotests/092 | 15 | ||||
| -rw-r--r-- | tests/qemu-iotests/092.out | 11 |
3 files changed, 34 insertions, 0 deletions
diff --git a/block/qcow.c b/block/qcow.c index 26bb9235c3..8718ca5e36 100644 --- a/block/qcow.c +++ b/block/qcow.c @@ -138,6 +138,14 @@ static int qcow_open(BlockDriverState *bs, QDict *options, int flags, goto fail; } + /* l2_bits specifies number of entries; storing a uint64_t in each entry, + * so bytes = num_entries << 3. */ + if (header.l2_bits < 9 - 3 || header.l2_bits > 16 - 3) { + error_setg(errp, "L2 table size must be between 512 and 64k"); + ret = -EINVAL; + goto fail; + } + if (header.crypt_method > QCOW_CRYPT_AES) { error_setg(errp, "invalid encryption method in qcow header"); ret = -EINVAL; diff --git a/tests/qemu-iotests/092 b/tests/qemu-iotests/092 index d060e6fa87..fb8bacc58c 100755 --- a/tests/qemu-iotests/092 +++ b/tests/qemu-iotests/092 @@ -44,6 +44,7 @@ _supported_proto generic _supported_os Linux offset_cluster_bits=32 +offset_l2_bits=33 echo echo "== Invalid cluster size ==" @@ -57,6 +58,20 @@ poke_file "$TEST_IMG" "$offset_cluster_bits" "\x08" poke_file "$TEST_IMG" "$offset_cluster_bits" "\x11" { $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir +echo +echo "== Invalid L2 table size ==" +_make_test_img 64M +poke_file "$TEST_IMG" "$offset_l2_bits" "\xff" +{ $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir +poke_file "$TEST_IMG" "$offset_l2_bits" "\x05" +{ $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir +poke_file "$TEST_IMG" "$offset_l2_bits" "\x0e" +{ $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir + +# 1 << 0x1b = 2^31 / L2_CACHE_SIZE +poke_file "$TEST_IMG" "$offset_l2_bits" "\x1b" +{ $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir + # success, all done echo "*** done" rm -f $seq.full diff --git a/tests/qemu-iotests/092.out b/tests/qemu-iotests/092.out index 8bf81580cd..73918b3c50 100644 --- a/tests/qemu-iotests/092.out +++ b/tests/qemu-iotests/092.out @@ -10,4 +10,15 @@ qemu-io: can't open device TEST_DIR/t.qcow: Cluster size must be between 512 and no file open, try 'help open' qemu-io: can't open device TEST_DIR/t.qcow: Cluster size must be between 512 and 64k no file open, try 'help open' + +== Invalid L2 table size == +Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 +qemu-io: can't open device TEST_DIR/t.qcow: L2 table size must be between 512 and 64k +no file open, try 'help open' +qemu-io: can't open device TEST_DIR/t.qcow: L2 table size must be between 512 and 64k +no file open, try 'help open' +qemu-io: can't open device TEST_DIR/t.qcow: L2 table size must be between 512 and 64k +no file open, try 'help open' +qemu-io: can't open device TEST_DIR/t.qcow: L2 table size must be between 512 and 64k +no file open, try 'help open' *** done |