summaryrefslogtreecommitdiffstats
path: root/block/dmg.c
diff options
context:
space:
mode:
authorDenis V. Lunev <den@openvz.org>2014-10-08 13:13:30 +0400
committerStefan Hajnoczi <stefanha@redhat.com>2014-11-03 09:48:41 +0000
commitda725d0b0e843ab496e0be6b9ead3cdd55cc0e3d (patch)
tree7c9302a8525abdb90cc9da035ab5f99e361c37f7 /block/dmg.c
parent76823c6e79583c926d127c33926aaf39475e5cda (diff)
downloadhqemu-da725d0b0e843ab496e0be6b9ead3cdd55cc0e3d.zip
hqemu-da725d0b0e843ab496e0be6b9ead3cdd55cc0e3d.tar.gz
block/parallels: fix access to not initialized memory in catalog_bitmap
found by valgrind. Command: ./qemu-img convert -f parallels -O qcow2 1.hds 1.img Invalid read of size 4 at 0x17D0EF: parallels_co_read (parallels.c:357) by 0x11FEE4: bdrv_aio_rw_vector (block.c:4640) by 0x11FFBF: bdrv_aio_readv_em (block.c:4652) by 0x11F55F: bdrv_co_readv_em (block.c:4862) by 0x123428: bdrv_aligned_preadv (block.c:3056) by 0x1239FA: bdrv_co_do_preadv (block.c:3162) by 0x125424: bdrv_rw_co_entry (block.c:2706) by 0x155DD9: coroutine_trampoline (coroutine-ucontext.c:118) by 0x6975B6F: ??? (in /lib/x86_64-linux-gnu/libc-2.19.so) The problem is that s->catalog_bitmap is allocated/filled as gmalloc(s->catalog_size) thus index validity check must be inclusive, i.e. index >= s->catalog_size is invalid. Signed-off-by: Denis V. Lunev <den@openvz.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-id: 1412759610-2257-4-git-send-email-den@openvz.org CC: Jeff Cody <jcody@redhat.com> CC: Kevin Wolf <kwolf@redhat.com> CC: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Diffstat (limited to 'block/dmg.c')
0 files changed, 0 insertions, 0 deletions
OpenPOWER on IntegriCloud