motorhead/qemu
1
0
Fork 0
mirror of https://github.com/Motorhead1991/qemu.git synced 2025-08-11 03:24:58 -06:00
Code Issues Projects Releases Packages Wiki Activity Actions

block: vhdx - fix reading beyond pointer during image creation

Browse source 
In vhdx_create_metadata(), we allocate 40 bytes to entry_buffer for
the various metadata table entries.  However, we write out 64kB from
that buffer into the new file.  Only write out the correct 40 bytes.

Signed-off-by: Jeff Cody <jcody@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
This commit is contained in:
Jeff Cody 2014-09-16 15:12:06 -04:00 • committed by Stefan Hajnoczi
parent 550830f935
commit e91a8b2fef
1 changed files with 8 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

16
block/vhdx.c
View file

@ -1408,6 +1408,12 @@ exit:
return ret; return ret;
} }
#define VHDX_METADATA_ENTRY_BUFFER_SIZE \
(sizeof(VHDXFileParameters) +\
sizeof(VHDXVirtualDiskSize) +\
sizeof(VHDXPage83Data) +\
sizeof(VHDXVirtualDiskLogicalSectorSize) +\
sizeof(VHDXVirtualDiskPhysicalSectorSize))
/* /*
* Create the Metadata entries. * Create the Metadata entries.
@ -1446,11 +1452,7 @@ static int vhdx_create_new_metadata(BlockDriverState *bs,
VHDXVirtualDiskLogicalSectorSize *mt_log_sector_size; VHDXVirtualDiskLogicalSectorSize *mt_log_sector_size;
VHDXVirtualDiskPhysicalSectorSize *mt_phys_sector_size; VHDXVirtualDiskPhysicalSectorSize *mt_phys_sector_size;
entry_buffer = g_malloc0(sizeof(VHDXFileParameters) + entry_buffer = g_malloc0(VHDX_METADATA_ENTRY_BUFFER_SIZE);
sizeof(VHDXVirtualDiskSize) +
sizeof(VHDXPage83Data) +
sizeof(VHDXVirtualDiskLogicalSectorSize) +
sizeof(VHDXVirtualDiskPhysicalSectorSize));
mt_file_params = entry_buffer; mt_file_params = entry_buffer;
offset += sizeof(VHDXFileParameters); offset += sizeof(VHDXFileParameters);
@ -1531,7 +1533,7 @@ static int vhdx_create_new_metadata(BlockDriverState *bs,
} }
ret = bdrv_pwrite(bs, metadata_offset + (64 * KiB), entry_buffer, ret = bdrv_pwrite(bs, metadata_offset + (64 * KiB), entry_buffer,
VHDX_HEADER_BLOCK_SIZE); VHDX_METADATA_ENTRY_BUFFER_SIZE);
if (ret < 0) { if (ret < 0) {
goto exit; goto exit;
} }
@ -1726,7 +1728,6 @@ static int vhdx_create_new_region_table(BlockDriverState *bs,
goto exit; goto exit;
} }
exit: exit:
g_free(s); g_free(s);
g_free(buffer); g_free(buffer);
@ -1877,7 +1878,6 @@ static int vhdx_create(const char *filename, QemuOpts *opts, Error **errp)
} }
delete_and_exit: delete_and_exit:
bdrv_unref(bs); bdrv_unref(bs);
exit: exit: