aboutsummaryrefslogtreecommitdiff
path: root/block/qcow2-cluster.c
diff options
context:
space:
mode:
authorMax Reitz <mreitz@redhat.com>2014-10-16 15:25:56 +0200
committerKevin Wolf <kwolf@redhat.com>2014-10-23 15:34:02 +0200
commita1391444fe1cfef14976458f3293a2c6945e725c (patch)
treea66c7c2da73dbf2ef603487f5cf79240ad2ac9d3 /block/qcow2-cluster.c
parent925bb3238d498172e8ee9a57842320b1d1bfc3a5 (diff)
downloadqemu-a1391444fe1cfef14976458f3293a2c6945e725c.zip
qemu-a1391444fe1cfef14976458f3293a2c6945e725c.tar.gz
qemu-a1391444fe1cfef14976458f3293a2c6945e725c.tar.bz2
qcow2: Do not overflow when writing an L1 sector
While writing an L1 table sector, qcow2_write_l1_entry() copies the respective range from s->l1_table to the local "buf" array. The size of s->l1_table does not have to be a multiple of L1_ENTRIES_PER_SECTOR; thus, limit the index which is used for copying all entries to the L1 size. Cc: qemu-stable@nongnu.org Signed-off-by: Max Reitz <mreitz@redhat.com> Reviewed-by: Peter Lieven <pl@kamp.de> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Diffstat (limited to 'block/qcow2-cluster.c')
-rw-r--r--block/qcow2-cluster.c6
1 files changed, 4 insertions, 2 deletions
diff --git a/block/qcow2-cluster.c b/block/qcow2-cluster.c
index f7dd8c0..4d888c7 100644
--- a/block/qcow2-cluster.c
+++ b/block/qcow2-cluster.c
@@ -164,12 +164,14 @@ static int l2_load(BlockDriverState *bs, uint64_t l2_offset,
int qcow2_write_l1_entry(BlockDriverState *bs, int l1_index)
{
BDRVQcowState *s = bs->opaque;
- uint64_t buf[L1_ENTRIES_PER_SECTOR];
+ uint64_t buf[L1_ENTRIES_PER_SECTOR] = { 0 };
int l1_start_index;
int i, ret;
l1_start_index = l1_index & ~(L1_ENTRIES_PER_SECTOR - 1);
- for (i = 0; i < L1_ENTRIES_PER_SECTOR; i++) {
+ for (i = 0; i < L1_ENTRIES_PER_SECTOR && l1_start_index + i < s->l1_size;
+ i++)
+ {
buf[i] = cpu_to_be64(s->l1_table[l1_start_index + i]);
}