Re: [Qemu-devel] [PATCH] qcow2: Fix fail path in realloc_refcount_block()

2014-03-17 Thread Max Reitz
On 16.03.2014 00:16, Benoît Canet wrote: The Saturday 15 Mar 2014 à 21:55:54 (+0100), Max Reitz wrote : If qcow2_alloc_clusters() fails, new_offset and ret will both be negative after the fail label, thus passing the first if condition and subsequently resulting in a call of qcow2_free_clusters(

Re: [Qemu-devel] [PATCH] qcow2: Fix fail path in realloc_refcount_block()

2014-03-17 Thread Laszlo Ersek
On 03/16/14 00:26, Benoît Canet wrote: > The Saturday 15 Mar 2014 à 21:55:54 (+0100), Max Reitz wrote : >> If qcow2_alloc_clusters() fails, new_offset and ret will both be >> negative after the fail label, thus passing the first if condition and >> subsequently resulting in a call of qcow2_free_clu

Re: [Qemu-devel] [PATCH] qcow2: Fix fail path in realloc_refcount_block()

2014-03-15 Thread Benoît Canet
The Saturday 15 Mar 2014 à 21:55:54 (+0100), Max Reitz wrote : > If qcow2_alloc_clusters() fails, new_offset and ret will both be > negative after the fail label, thus passing the first if condition and > subsequently resulting in a call of qcow2_free_clusters() with an > invalid (negative) offset

Re: [Qemu-devel] [PATCH] qcow2: Fix fail path in realloc_refcount_block()

2014-03-15 Thread Benoît Canet
The Saturday 15 Mar 2014 à 21:55:54 (+0100), Max Reitz wrote : > If qcow2_alloc_clusters() fails, new_offset and ret will both be > negative after the fail label, thus passing the first if condition and > subsequently resulting in a call of qcow2_free_clusters() with an > invalid (negative) offset

[Qemu-devel] [PATCH] qcow2: Fix fail path in realloc_refcount_block()

2014-03-15 Thread Max Reitz
If qcow2_alloc_clusters() fails, new_offset and ret will both be negative after the fail label, thus passing the first if condition and subsequently resulting in a call of qcow2_free_clusters() with an invalid (negative) offset parameter. Fix this by checking for new_offset being positive instead.