diff options
Diffstat (limited to 'block')
| -rw-r--r-- | block/parallels.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/block/parallels.c b/block/parallels.c index 3f588f5..fe47ecb 100644 --- a/block/parallels.c +++ b/block/parallels.c @@ -49,7 +49,7 @@ typedef struct BDRVParallelsState { CoMutex lock; uint32_t *catalog_bitmap; - int catalog_size; + unsigned int catalog_size; int tracks; } BDRVParallelsState; @@ -95,6 +95,11 @@ static int parallels_open(BlockDriverState *bs, QDict *options, int flags, s->tracks = le32_to_cpu(ph.tracks); s->catalog_size = le32_to_cpu(ph.catalog_entries); + if (s->catalog_size > INT_MAX / 4) { + error_setg(errp, "Catalog too large"); + ret = -EFBIG; + goto fail; + } s->catalog_bitmap = g_malloc(s->catalog_size * 4); ret = bdrv_pread(bs->file, 64, s->catalog_bitmap, s->catalog_size * 4); |