aboutsummaryrefslogtreecommitdiff
path: root/block
diff options
context:
space:
mode:
authorKevin Wolf <kwolf@redhat.com>2010-06-22 12:31:45 +0200
committerKevin Wolf <kwolf@redhat.com>2010-06-22 14:38:02 +0200
commit6882c8fa78dcc4882640d3e11232d995fda7d5c4 (patch)
tree13788e57b424d164711bc2268e9baf4f9d99777d /block
parent20a81e4d178379381fbd522eda5f664ba2ecdaaa (diff)
downloadqemu-6882c8fa78dcc4882640d3e11232d995fda7d5c4.zip
qemu-6882c8fa78dcc4882640d3e11232d995fda7d5c4.tar.gz
qemu-6882c8fa78dcc4882640d3e11232d995fda7d5c4.tar.bz2
qcow2: Fix qemu-img check segfault on corrupted images
With corrupted images, we can easily get an cluster index that exceeds the array size of the temporary refcount table. Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Diffstat (limited to 'block')
-rw-r--r--block/qcow2-refcount.c14
1 files changed, 11 insertions, 3 deletions
diff --git a/block/qcow2-refcount.c b/block/qcow2-refcount.c
index c2d0e61..cedf57e 100644
--- a/block/qcow2-refcount.c
+++ b/block/qcow2-refcount.c
@@ -1140,22 +1140,30 @@ int qcow2_check_refcounts(BlockDriverState *bs)
s->refcount_table_offset,
s->refcount_table_size * sizeof(uint64_t));
for(i = 0; i < s->refcount_table_size; i++) {
- int64_t offset;
+ uint64_t offset, cluster;
offset = s->refcount_table[i];
+ cluster = offset >> s->cluster_bits;
/* Refcount blocks are cluster aligned */
if (offset & (s->cluster_size - 1)) {
fprintf(stderr, "ERROR refcount block %d is not "
"cluster aligned; refcount table entry corrupted\n", i);
errors++;
+ continue;
+ }
+
+ if (cluster >= nb_clusters) {
+ fprintf(stderr, "ERROR refcount block %d is outside image\n", i);
+ errors++;
+ continue;
}
if (offset != 0) {
errors += inc_refcounts(bs, refcount_table, nb_clusters,
offset, s->cluster_size);
- if (refcount_table[offset / s->cluster_size] != 1) {
+ if (refcount_table[cluster] != 1) {
fprintf(stderr, "ERROR refcount block %d refcount=%d\n",
- i, refcount_table[offset / s->cluster_size]);
+ i, refcount_table[cluster]);
}
}
}