diff options
| author | Hu Tao | 2014-01-26 04:12:38 +0100 |
|---|---|---|
| committer | Kevin Wolf | 2014-02-09 09:12:39 +0100 |
| commit | 33304ec9fa484e765c6249673e09e1b7d49c5b85 (patch) | |
| tree | 9e469f03b22e55233921b39cb9c6ec765dceb293 /scripts | |
| parent | qcow2: remove n_start and n_end of qcow2_alloc_cluster_offset() (diff) | |
| download | qemu-33304ec9fa484e765c6249673e09e1b7d49c5b85.tar.gz qemu-33304ec9fa484e765c6249673e09e1b7d49c5b85.tar.xz qemu-33304ec9fa484e765c6249673e09e1b7d49c5b85.zip | |
qcow2: fix offset overflow in qcow2_alloc_clusters_at()
When cluster size is big enough it can lead to an offset overflow
in qcow2_alloc_clusters_at(). This patch fixes it.
The allocation is stopped each time at L2 table boundary
(see handle_alloc()), so the possible maximum bytes could be
2^(cluster_bits - 3 + cluster_bits)
cluster_bits - 3 is used to compute the number of entry by L2
and the additional cluster_bits is to take into account each
clusters referenced by the L2 entries.
so int is safe for cluster_bits<=17, unsafe otherwise.
Signed-off-by: Hu Tao <hutao@cn.fujitsu.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Benoit Canet <benoit@irqsave.net>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Diffstat (limited to 'scripts')
0 files changed, 0 insertions, 0 deletions