aboutsummaryrefslogtreecommitdiff
path: root/block
diff options
context:
space:
mode:
authorVladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>2020-12-11 21:39:21 +0300
committerEric Blake <eblake@redhat.com>2021-02-03 08:00:33 -0600
commita56ed80c429610aecd6f74fbd4a9467f5466278a (patch)
tree0e15ac7e2d6d667282288ee1085cecaa99c4ff21 /block
parent4c002cef0e9abe7135d7916c51abce47f7fc1ee2 (diff)
downloadqemu-a56ed80c429610aecd6f74fbd4a9467f5466278a.zip
qemu-a56ed80c429610aecd6f74fbd4a9467f5466278a.tar.gz
qemu-a56ed80c429610aecd6f74fbd4a9467f5466278a.tar.bz2
block: fix theoretical overflow in bdrv_init_padding()
Calculation of sum may theoretically overflow, so use 64bit type and add some good assertions. Use int64_t constantly. Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Message-Id: <20201211183934.169161-4-vsementsov@virtuozzo.com> Reviewed-by: Eric Blake <eblake@redhat.com> [eblake: tweak assertion order] Signed-off-by: Eric Blake <eblake@redhat.com>
Diffstat (limited to 'block')
-rw-r--r--block/io.c8
1 files changed, 6 insertions, 2 deletions
diff --git a/block/io.c b/block/io.c
index ab953bd..c8c9dea 100644
--- a/block/io.c
+++ b/block/io.c
@@ -1565,8 +1565,12 @@ static bool bdrv_init_padding(BlockDriverState *bs,
int64_t offset, int64_t bytes,
BdrvRequestPadding *pad)
{
- uint64_t align = bs->bl.request_alignment;
- size_t sum;
+ int64_t align = bs->bl.request_alignment;
+ int64_t sum;
+
+ bdrv_check_request(offset, bytes, &error_abort);
+ assert(align <= INT_MAX); /* documented in block/block_int.h */
+ assert(align <= SIZE_MAX / 2); /* so we can allocate the buffer */
memset(pad, 0, sizeof(*pad));