motorhead/qemu
1
0
Fork 0
mirror of https://github.com/Motorhead1991/qemu.git synced 2025-08-04 08:13:54 -06:00
Code Issues Projects Releases Packages Wiki Activity Actions

qcow2: avoid memcpy(dst, NULL, len)

Browse source 
Section "7.1.4 Use of library functions" in the C99 standard says:

  If an argument to a function has an invalid value (such as [...]
  a null pointer [...]) [...] the behavior is undefined.

Additionally the "searching and sorting" functions are specified as
requiring valid pointer values as described in 7.1.4.

This patch fixes the following sanitizer errors:

  block/qcow2.c:1807:41: runtime error: null pointer passed as argument 2, which is declared to never be null
  block/qcow2-cluster.c:86:26: runtime error: null pointer passed as argument 2, which is declared to never be null

Reported-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-id: 1473758138-19260-1-git-send-email-stefanha@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
This commit is contained in:
Stefan Hajnoczi 2016-09-13 09:56:27 +01:00
parent 7263da7804
commit 0647d47cc1
2 changed files with 7 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
block/qcow2-cluster.c
View file

@ -83,7 +83,9 @@ int qcow2_grow_l1_table(BlockDriverState *bs, uint64_t min_size,
} }
memset(new_l1_table, 0, align_offset(new_l1_size2, 512)); memset(new_l1_table, 0, align_offset(new_l1_size2, 512));
memcpy(new_l1_table, s->l1_table, s->l1_size * sizeof(uint64_t)); if (s->l1_size) {
memcpy(new_l1_table, s->l1_table, s->l1_size * sizeof(uint64_t));
}
/* write new table (align to cluster) */ /* write new table (align to cluster) */
BLKDBG_EVENT(bs->file, BLKDBG_L1_GROW_ALLOC_TABLE); BLKDBG_EVENT(bs->file, BLKDBG_L1_GROW_ALLOC_TABLE);

5
block/qcow2.c
View file

@ -1804,7 +1804,10 @@ static size_t header_ext_add(char *buf, uint32_t magic, const void *s,
.magic = cpu_to_be32(magic), .magic = cpu_to_be32(magic),
.len = cpu_to_be32(len), .len = cpu_to_be32(len),
}; };
memcpy(buf + sizeof(QCowExtension), s, len);
if (len) {
memcpy(buf + sizeof(QCowExtension), s, len);
}
return ext_len; return ext_len;
} }