Commit 91f827dc authored by Max Reitz's avatar Max Reitz Committed by Kevin Wolf
Browse files

qcow2: Avoid overflow in alloc_clusters_noref() 



alloc_clusters_noref() stores the cluster index in a uint64_t. However,
offsets are often represented as int64_t (as for example the return
value of alloc_clusters_noref() itself demonstrates). Therefore, we
should make sure all offsets in the allocated range of clusters are
representable using int64_t without overflows.

Signed-off-by: default avatarMax Reitz <mreitz@redhat.com>
Signed-off-by: default avatarKevin Wolf <kwolf@redhat.com>
parent 35d0d40a

block/qcow2-refcount.c

+7 −0
Original line number Diff line number Diff line
@@ -653,6 +653,13 @@ retry: 
            goto retry;

        }

    }



    /* Make sure that all offsets in the "allocated" range are representable

     * in an int64_t */

    if (s->free_cluster_index - 1 > (INT64_MAX >> s->cluster_bits)) {

        return -EFBIG;

    }



#ifdef DEBUG_ALLOC2

    fprintf(stderr, "alloc_clusters: size=%" PRId64 " -> %" PRId64 "\n",

            size,