diff options
| author | Max Reitz <mreitz@redhat.com> | 2013-09-25 17:48:55 +0200 |
|---|---|---|
| committer | Kevin Wolf <kwolf@redhat.com> | 2013-09-25 21:57:44 +0200 |
| commit | c01dbccbad647be5784be39eb8fa0144732295db (patch) | |
| tree | a271d7b25995e66a5782e449cc5911b60b4dc404 | |
| parent | 687fb89366366ce654a17c15af48adfe8c4ce70a (diff) | |
| download | hqemu-c01dbccbad647be5784be39eb8fa0144732295db.zip hqemu-c01dbccbad647be5784be39eb8fa0144732295db.tar.gz | |
qcow2: Assert against currently impossible overflow
If qcow2_alloc_cluster_link_l2 is called with a QCowL2Meta describing a
request crossing L2 boundaries, a buffer overflow will occur. This is
impossible right now since such requests are never generated (every
request is shortened to L2 boundaries before) and probably also
completely unintended (considering the name "QCowL2Meta"), however, it
is still worth an assertion.
Signed-off-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
| -rw-r--r-- | block/qcow2-cluster.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/block/qcow2-cluster.c b/block/qcow2-cluster.c index 738ff73..cab5f2e 100644 --- a/block/qcow2-cluster.c +++ b/block/qcow2-cluster.c @@ -716,6 +716,7 @@ int qcow2_alloc_cluster_link_l2(BlockDriverState *bs, QCowL2Meta *m) } qcow2_cache_entry_mark_dirty(s->l2_table_cache, l2_table); + assert(l2_index + m->nb_clusters <= s->l2_size); for (i = 0; i < m->nb_clusters; i++) { /* if two concurrent writes happen to the same unallocated cluster * each write allocates separate cluster and writes data concurrently. |
