Commit 9a29e18f authored by Jeff Cody's avatar Jeff Cody Committed by Kevin Wolf
Browse files

block: update string sizes for filename,backing_file,exact_filename 



The string field entries 'filename', 'backing_file', and
'exact_filename' in the BlockDriverState struct are defined as 1024
bytes.

However, many places that use these values accept a maximum of PATH_MAX
bytes, so we have a mixture of 1024 byte and PATH_MAX byte allocations.
This patch makes the BlockDriverStruct field string sizes match usage.

This patch also does a few fixes related to the size that needs to
happen now:

    * the block qapi driver is updated to use PATH_MAX bytes
    * the qcow and qcow2 drivers have an additional safety check
    * the block vvfat driver is updated to use PATH_MAX bytes
      for the size of backing_file, for systems where PATH_MAX is < 1024
      bytes.
    * qemu-img uses PATH_MAX rather than 1024.  These instances were not
      changed to be dynamically allocated, however, as the extra
      temporary 3K in stack usage for qemu-img does not seem worrisome.

Reviewed-by: default avatarStefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: default avatarJohn Snow <jsnow@redhat.com>
Signed-off-by: default avatarJeff Cody <jcody@redhat.com>
Signed-off-by: default avatarKevin Wolf <kwolf@redhat.com>
parent 1d33936e

block/qapi.c

+2 −2
Original line number Diff line number Diff line
@@ -210,10 +210,10 @@ void bdrv_query_image_info(BlockDriverState *bs, 


    backing_filename = bs->backing_file;

    if (backing_filename[0] != '\0') {

        char *backing_filename2 = g_malloc0(1024);

        char *backing_filename2 = g_malloc0(PATH_MAX);

        info->backing_filename = g_strdup(backing_filename);

        info->has_backing_filename = true;

        bdrv_get_full_backing_filename(bs, backing_filename2, 1024, &err);

        bdrv_get_full_backing_filename(bs, backing_filename2, PATH_MAX, &err);

        if (err) {

            error_propagate(errp, err);

            qapi_free_ImageInfo(info);

block/qcow.c

+1 −1
Original line number Diff line number Diff line
@@ -215,7 +215,7 @@ static int qcow_open(BlockDriverState *bs, QDict *options, int flags, 
    /* read the backing file name */

    if (header.backing_file_offset != 0) {

        len = header.backing_file_size;

        if (len > 1023) {

        if (len > 1023 || len > sizeof(bs->backing_file)) {

            error_setg(errp, "Backing file name too long");

            ret = -EINVAL;

            goto fail;

block/qcow2.c

+2 −1
Original line number Diff line number Diff line
@@ -868,7 +868,8 @@ static int qcow2_open(BlockDriverState *bs, QDict *options, int flags, 
    /* read the backing file name */

    if (header.backing_file_offset != 0) {

        len = header.backing_file_size;

        if (len > MIN(1023, s->cluster_size - header.backing_file_offset)) {

        if (len > MIN(1023, s->cluster_size - header.backing_file_offset) ||

            len > sizeof(bs->backing_file)) {

            error_setg(errp, "Backing file name too long");

            ret = -EINVAL;

            goto fail;

block/vvfat.c

+2 −2
Original line number Diff line number Diff line
@@ -2909,8 +2909,8 @@ static int enable_write_target(BDRVVVFATState *s, Error **errp) 


    array_init(&(s->commits), sizeof(commit_t));



    s->qcow_filename = g_malloc(1024);

    ret = get_tmp_filename(s->qcow_filename, 1024);

    s->qcow_filename = g_malloc(PATH_MAX);

    ret = get_tmp_filename(s->qcow_filename, PATH_MAX);

    if (ret < 0) {

        error_setg_errno(errp, -ret, "can't create temporary file");

        goto err;

include/block/block_int.h

+4 −4
Original line number Diff line number Diff line
@@ -339,13 +339,13 @@ struct BlockDriverState { 
     * regarding this BDS's context */

    QLIST_HEAD(, BdrvAioNotifier) aio_notifiers;



    char filename[1024];

    char backing_file[1024]; /* if non zero, the image is a diff of

    char filename[PATH_MAX];

    char backing_file[PATH_MAX]; /* if non zero, the image is a diff of

                                    this file image */

    char backing_format[16]; /* if non-zero and backing_file exists */



    QDict *full_open_options;

    char exact_filename[1024];

    char exact_filename[PATH_MAX];



    BlockDriverState *backing_hd;

    BlockDriverState *file;