On 2014-11-25 at 18:12, Kevin Wolf wrote:
After reading the extension header, offset is incremented, but not
checked against end_offset any more. This way an integer overflow could
happen when checking whether the extension end is within the allowed
range, effectively disabling the check.
This patch adds the missing check and a test case for it.
Cc: qemu-sta...@nongnu.org
Reported-by: Max Reitz <mre...@redhat.com>
Signed-off-by: Kevin Wolf <kw...@redhat.com>
---
block/qcow2.c | 2 +-
tests/qemu-iotests/080 | 2 ++
tests/qemu-iotests/080.out | 2 ++
3 files changed, 5 insertions(+), 1 deletion(-)
Reviewed-by: Max Reitz <mre...@redhat.com>
Using g_try_malloc0() might have been nice anyway, but it should work
without, now (although it should have worked before as well...).
