motorhead/qemu
1
0
Fork 0
mirror of https://github.com/Motorhead1991/qemu.git synced 2025-08-04 08:13:54 -06:00
Code Issues Projects Releases Packages Wiki Activity Actions

qcow2-refcount: avoid eating RAM

Browse source 
qcow2_inc_refcounts_imrt() (through realloc_refcount_array()) can eat
an unpredictable amount of memory on corrupted table entries, which are
referencing regions far beyond the end of file.

Prevent this, by skipping such regions from further processing.

Interesting that iotest 138 checks exactly the behavior which we fix
here. So, change the test appropriately.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Message-id: 20190227131433.197063-3-vsementsov@virtuozzo.com
Signed-off-by: Max Reitz <mreitz@redhat.com>
This commit is contained in:
Vladimir Sementsov-Ogievskiy 2019-02-27 16:14:30 +03:00 • committed by Max Reitz
parent 7e3e736cbd
commit a5fff8d4b4
3 changed files with 28 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

19
block/qcow2-refcount.c
View file

@ -1520,12 +1520,31 @@ int qcow2_inc_refcounts_imrt(BlockDriverState *bs, BdrvCheckResult *res,
{
BDRVQcow2State *s = bs->opaque;
uint64_t start, last, cluster_offset, k, refcount;
int64_t file_len;
int ret;
if (size <= 0) {
return 0;
}
file_len = bdrv_getlength(bs->file->bs);
if (file_len < 0) {
return file_len;
}
/*
* Last cluster of qcow2 image may be semi-allocated, so it may be OK to
* reference some space after file end but it should be less than one
* cluster.
*/
if (offset + size - file_len >= s->cluster_size) {
fprintf(stderr, "ERROR: counting reference for region exceeding the "
"end of the file by one cluster or more: offset 0x%" PRIx64
" size 0x%" PRIx64 "\n", offset, size);
res->corruptions++;
return 0;
}
start = start_of_cluster(s, offset);
last = start_of_cluster(s, offset + size - 1);
for(cluster_offset = start; cluster_offset <= last;