From 40332872fec584d2557ed2c3f48d55d15d95eddb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Golembiovsk=C3=BD?= Date: Thu, 3 Nov 2016 14:47:48 +0100 Subject: raw_bsd: move check to prevent overflow MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When only offset is specified but no size and the offset is greater than the real size of the containing device an overflow occurs when parsing the options. This overflow is harmless because we do check for this exact situation little bit later, but it leads to an error message with weird values. It is better to do the check is sooner and prevent the overflow. Signed-off-by: Tomáš Golembiovský Signed-off-by: Kevin Wolf --- block/raw_bsd.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) (limited to 'block') diff --git a/block/raw_bsd.c b/block/raw_bsd.c index 7c9bebb507..cf7a5606ed 100644 --- a/block/raw_bsd.c +++ b/block/raw_bsd.c @@ -91,6 +91,14 @@ static int raw_read_options(QDict *options, BlockDriverState *bs, } s->offset = qemu_opt_get_size(opts, "offset", 0); + if (s->offset > real_size) { + error_setg(errp, "Offset (%" PRIu64 ") cannot be greater than " + "size of the containing file (%" PRId64 ")", + s->offset, real_size); + ret = -EINVAL; + goto end; + } + if (qemu_opt_find(opts, "size") != NULL) { s->size = qemu_opt_get_size(opts, "size", 0); s->has_size = true; @@ -100,7 +108,7 @@ static int raw_read_options(QDict *options, BlockDriverState *bs, } /* Check size and offset */ - if (real_size < s->offset || (real_size - s->offset) < s->size) { + if ((real_size - s->offset) < s->size) { error_setg(errp, "The sum of offset (%" PRIu64 ") and size " "(%" PRIu64 ") has to be smaller or equal to the " " actual size of the containing file (%" PRId64 ")", -- cgit v1.2.1