diff options
Diffstat (limited to 'block')
| -rw-r--r-- | block/qapi.c | 4 | ||||
| -rw-r--r-- | block/qcow.c | 2 | ||||
| -rw-r--r-- | block/qcow2.c | 3 | ||||
| -rw-r--r-- | block/vvfat.c | 4 |
4 files changed, 7 insertions, 6 deletions
diff --git a/block/qapi.c b/block/qapi.c index dec9f60..75c388e 100644 --- a/block/qapi.c +++ b/block/qapi.c @@ -210,10 +210,10 @@ void bdrv_query_image_info(BlockDriverState *bs, backing_filename = bs->backing_file; if (backing_filename[0] != '\0') { - char *backing_filename2 = g_malloc0(1024); + char *backing_filename2 = g_malloc0(PATH_MAX); info->backing_filename = g_strdup(backing_filename); info->has_backing_filename = true; - bdrv_get_full_backing_filename(bs, backing_filename2, 1024, &err); + bdrv_get_full_backing_filename(bs, backing_filename2, PATH_MAX, &err); if (err) { error_propagate(errp, err); qapi_free_ImageInfo(info); diff --git a/block/qcow.c b/block/qcow.c index ece2269..ccbe9e0 100644 --- a/block/qcow.c +++ b/block/qcow.c @@ -215,7 +215,7 @@ static int qcow_open(BlockDriverState *bs, QDict *options, int flags, /* read the backing file name */ if (header.backing_file_offset != 0) { len = header.backing_file_size; - if (len > 1023) { + if (len > 1023 || len > sizeof(bs->backing_file)) { error_setg(errp, "Backing file name too long"); ret = -EINVAL; goto fail; diff --git a/block/qcow2.c b/block/qcow2.c index e4e690a..dbaf016 100644 --- a/block/qcow2.c +++ b/block/qcow2.c @@ -868,7 +868,8 @@ static int qcow2_open(BlockDriverState *bs, QDict *options, int flags, /* read the backing file name */ if (header.backing_file_offset != 0) { len = header.backing_file_size; - if (len > MIN(1023, s->cluster_size - header.backing_file_offset)) { + if (len > MIN(1023, s->cluster_size - header.backing_file_offset) || + len > sizeof(bs->backing_file)) { error_setg(errp, "Backing file name too long"); ret = -EINVAL; goto fail; diff --git a/block/vvfat.c b/block/vvfat.c index e34a789..a1a44f0 100644 --- a/block/vvfat.c +++ b/block/vvfat.c @@ -2909,8 +2909,8 @@ static int enable_write_target(BDRVVVFATState *s, Error **errp) array_init(&(s->commits), sizeof(commit_t)); - s->qcow_filename = g_malloc(1024); - ret = get_tmp_filename(s->qcow_filename, 1024); + s->qcow_filename = g_malloc(PATH_MAX); + ret = get_tmp_filename(s->qcow_filename, PATH_MAX); if (ret < 0) { error_setg_errno(errp, -ret, "can't create temporary file"); goto err; |