[Qemu-devel] [PATCH 1/2] qcow2: Do not overflow when writing an L1 sector

[Max Reitz]

While writing an L1 table sector, qcow2_write_l1_entry() copies the
respective range from s->l1_table to the local "buf" array. The size of
s->l1_table does not have to be a multiple of L1_ENTRIES_PER_SECTOR;
thus, limit the index which is used for copying all entries to the L1
size.

Cc: qemu-sta...@nongnu.org
Signed-off-by: Max Reitz 
---
 block/qcow2-cluster.c | 6 --
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/block/qcow2-cluster.c b/block/qcow2-cluster.c
index f7dd8c0..4d888c7 100644
--- a/block/qcow2-cluster.c
+++ b/block/qcow2-cluster.c
@@ -164,12 +164,14 @@ static int l2_load(BlockDriverState *bs, uint64_t 
l2_offset,
 int qcow2_write_l1_entry(BlockDriverState *bs, int l1_index)
 {
 BDRVQcowState *s = bs->opaque;
-uint64_t buf[L1_ENTRIES_PER_SECTOR];
+uint64_t buf[L1_ENTRIES_PER_SECTOR] = { 0 };
 int l1_start_index;
 int i, ret;
 
 l1_start_index = l1_index & ~(L1_ENTRIES_PER_SECTOR - 1);
-for (i = 0; i < L1_ENTRIES_PER_SECTOR; i++) {
+for (i = 0; i < L1_ENTRIES_PER_SECTOR && l1_start_index + i < s->l1_size;
+ i++)
+{
 buf[i] = cpu_to_be64(s->l1_table[l1_start_index + i]);
 }
 
-- 
2.1.2

Re: [Qemu-devel] [PATCH 1/2] qcow2: Do not overflow when writing an L1 sector

[Peter Lieven]

On 16.10.2014 15:25, Max Reitz wrote:

While writing an L1 table sector, qcow2_write_l1_entry() copies the
respective range from s->l1_table to the local "buf" array. The size of
s->l1_table does not have to be a multiple of L1_ENTRIES_PER_SECTOR;
thus, limit the index which is used for copying all entries to the L1
size.

Cc: qemu-sta...@nongnu.org
Signed-off-by: Max Reitz 
---
  block/qcow2-cluster.c | 6 --
  1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/block/qcow2-cluster.c b/block/qcow2-cluster.c
index f7dd8c0..4d888c7 100644
--- a/block/qcow2-cluster.c
+++ b/block/qcow2-cluster.c
@@ -164,12 +164,14 @@ static int l2_load(BlockDriverState *bs, uint64_t 
l2_offset,
  int qcow2_write_l1_entry(BlockDriverState *bs, int l1_index)
  {
  BDRVQcowState *s = bs->opaque;
-uint64_t buf[L1_ENTRIES_PER_SECTOR];
+uint64_t buf[L1_ENTRIES_PER_SECTOR] = { 0 };
  int l1_start_index;
  int i, ret;
  
  l1_start_index = l1_index & ~(L1_ENTRIES_PER_SECTOR - 1);

-for (i = 0; i < L1_ENTRIES_PER_SECTOR; i++) {
+for (i = 0; i < L1_ENTRIES_PER_SECTOR && l1_start_index + i < s->l1_size;
+ i++)
+{
  buf[i] = cpu_to_be64(s->l1_table[l1_start_index + i]);
  }
  


Reviewed-by: Peter Lieven