Commit 0647d47c authored Sep 13, 2016 by Stefan Hajnoczi

qcow2: avoid memcpy(dst, NULL, len)

Section "7.1.4 Use of library functions" in the C99 standard says:

If an argument to a function has an invalid value (such as [...]
a null pointer [...]) [...] the behavior is undefined.

Additionally the "searching and sorting" functions are specified as
requiring valid pointer values as described in 7.1.4.

This patch fixes the following sanitizer errors:

block/qcow2.c:1807:41: runtime error: null pointer passed as argument 2, which is declared to never be null
block/qcow2-cluster.c:86:26: runtime error: null pointer passed as argument 2, which is declared to never be null

Reported-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-id: 1473758138-19260-1-git-send-email-stefanha@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

parent 7263da78

block/qcow2-cluster.c

+3 −1

Original line number	Diff line number	Diff line
		@@ -83,7 +83,9 @@ int qcow2_grow_l1_table(BlockDriverState *bs, uint64_t min_size,
		}
		memset(new_l1_table, 0, align_offset(new_l1_size2, 512));

		if (s->l1_size) {
		memcpy(new_l1_table, s->l1_table, s->l1_size * sizeof(uint64_t));
		}

		/* write new table (align to cluster) */
		BLKDBG_EVENT(bs->file, BLKDBG_L1_GROW_ALLOC_TABLE);

block/qcow2.c

+4 −1

Original line number	Diff line number	Diff line
		@@ -1804,7 +1804,10 @@ static size_t header_ext_add(char buf, uint32_t magic, const void s,
		.magic = cpu_to_be32(magic),
		.len = cpu_to_be32(len),
		};

		if (len) {
		memcpy(buf + sizeof(QCowExtension), s, len);
		}

		return ext_len;
		}