Commit 69d34a36 authored by Kevin Wolf's avatar Kevin Wolf Committed by Stefan Hajnoczi
Browse files

dmg: Fix bdrv_open() error handling 



Return -errno instead of -1 on errors and add error checks in some
places that didn't have one. Passing things by reference requires more
correct typing, replaced a few off_ts therefore - with a 32-bit off_t
this is even a fix for truncation bugs.

While touching the code, fix even some more memory leaks than in the
other drivers...

Signed-off-by: default avatarKevin Wolf <kwolf@redhat.com>
Signed-off-by: default avatarStefan Hajnoczi <stefanha@redhat.com>
parent 59294e46

block/dmg.c

+97 −38
Original line number Diff line number Diff line
@@ -57,29 +57,42 @@ static int dmg_probe(const uint8_t *buf, int buf_size, const char *filename) 
    return 0;

}



static off_t read_off(BlockDriverState *bs, int64_t offset)

static int read_uint64(BlockDriverState *bs, int64_t offset, uint64_t *result)

{

    uint64_t buffer;

	if (bdrv_pread(bs->file, offset, &buffer, 8) < 8)

    int ret;



    ret = bdrv_pread(bs->file, offset, &buffer, 8);

    if (ret < 0) {

        return ret;

    }



    *result = be64_to_cpu(buffer);

    return 0;

	return be64_to_cpu(buffer);

}



static off_t read_uint32(BlockDriverState *bs, int64_t offset)

static int read_uint32(BlockDriverState *bs, int64_t offset, uint32_t *result)

{

    uint32_t buffer;

	if (bdrv_pread(bs->file, offset, &buffer, 4) < 4)

    int ret;



    ret = bdrv_pread(bs->file, offset, &buffer, 4);

    if (ret < 0) {

        return ret;

    }



    *result = be32_to_cpu(buffer);

    return 0;

	return be32_to_cpu(buffer);

}



static int dmg_open(BlockDriverState *bs, int flags)

{

    BDRVDMGState *s = bs->opaque;

    off_t info_begin,info_end,last_in_offset,last_out_offset;

    uint32_t count;

    uint64_t info_begin,info_end,last_in_offset,last_out_offset;

    uint32_t count, tmp;

    uint32_t max_compressed_size=1,max_sectors_per_chunk=1,i;

    int64_t offset;

    int ret;



    bs->read_only = 1;

    s->n_chunks = 0;
@@ -88,21 +101,32 @@ static int dmg_open(BlockDriverState *bs, int flags) 
    /* read offset of info blocks */

    offset = bdrv_getlength(bs->file);

    if (offset < 0) {

        ret = offset;

        goto fail;

    }

    offset -= 0x1d8;



    info_begin = read_off(bs, offset);

    if (info_begin == 0) {

    ret = read_uint64(bs, offset, &info_begin);

    if (ret < 0) {

        goto fail;

    } else if (info_begin == 0) {

        ret = -EINVAL;

        goto fail;

    }



    if (read_uint32(bs, info_begin) != 0x100) {

    ret = read_uint32(bs, info_begin, &tmp);

    if (ret < 0) {

        goto fail;

    } else if (tmp != 0x100) {

        ret = -EINVAL;

        goto fail;

    }



    count = read_uint32(bs, info_begin + 4);

    if (count == 0) {

    ret = read_uint32(bs, info_begin + 4, &count);

    if (ret < 0) {

        goto fail;

    } else if (count == 0) {

        ret = -EINVAL;

        goto fail;

    }

    info_end = info_begin + count;
@@ -114,12 +138,20 @@ static int dmg_open(BlockDriverState *bs, int flags) 
    while (offset < info_end) {

        uint32_t type;



	count = read_uint32(bs, offset);

	if(count==0)

        ret = read_uint32(bs, offset, &count);

        if (ret < 0) {

            goto fail;

        } else if (count == 0) {

            ret = -EINVAL;

            goto fail;

        }

        offset += 4;



	type = read_uint32(bs, offset);

        ret = read_uint32(bs, offset, &type);

        if (ret < 0) {

            goto fail;

        }



	if (type == 0x6d697368 && count >= 244) {

	    int new_size, chunk_count;
@@ -135,7 +167,10 @@ static int dmg_open(BlockDriverState *bs, int flags) 
	    s->sectorcounts = g_realloc(s->sectorcounts, new_size);



            for (i = s->n_chunks; i < s->n_chunks + chunk_count; i++) {

		s->types[i] = read_uint32(bs, offset);

                ret = read_uint32(bs, offset, &s->types[i]);

                if (ret < 0) {

                    goto fail;

                }

		offset += 4;

		if(s->types[i]!=0x80000005 && s->types[i]!=1 && s->types[i]!=2) {

		    if(s->types[i]==0xffffffff) {
@@ -149,16 +184,30 @@ static int dmg_open(BlockDriverState *bs, int flags) 
		}

		offset += 4;



		s->sectors[i] = last_out_offset+read_off(bs, offset);

                ret = read_uint64(bs, offset, &s->sectors[i]);

                if (ret < 0) {

                    goto fail;

                }

                s->sectors[i] += last_out_offset;

                offset += 8;



		s->sectorcounts[i] = read_off(bs, offset);

                ret = read_uint64(bs, offset, &s->sectorcounts[i]);

                if (ret < 0) {

                    goto fail;

                }

                offset += 8;



		s->offsets[i] = last_in_offset+read_off(bs, offset);

                ret = read_uint64(bs, offset, &s->offsets[i]);

                if (ret < 0) {

                    goto fail;

                }

                s->offsets[i] += last_in_offset;

                offset += 8;



		s->lengths[i] = read_off(bs, offset);

                ret = read_uint64(bs, offset, &s->lengths[i]);

                if (ret < 0) {

                    goto fail;

                }

                offset += 8;



		if(s->lengths[i]>max_compressed_size)
@@ -173,15 +222,25 @@ static int dmg_open(BlockDriverState *bs, int flags) 
    /* initialize zlib engine */

    s->compressed_chunk = g_malloc(max_compressed_size+1);

    s->uncompressed_chunk = g_malloc(512*max_sectors_per_chunk);

    if(inflateInit(&s->zstream) != Z_OK)

    if(inflateInit(&s->zstream) != Z_OK) {

        ret = -EINVAL;

        goto fail;

    }



    s->current_chunk = s->n_chunks;



    qemu_co_mutex_init(&s->lock);

    return 0;



fail:

    return -1;

    g_free(s->types);

    g_free(s->offsets);

    g_free(s->lengths);

    g_free(s->sectors);

    g_free(s->sectorcounts);

    g_free(s->compressed_chunk);

    g_free(s->uncompressed_chunk);

    return ret;

}



static inline int is_sector_in_chunk(BDRVDMGState* s,