From patchwork Fri Apr 15 17:02:10 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kevin Wolf X-Patchwork-Id: 8852431 Return-Path: X-Original-To: patchwork-qemu-devel@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id 01610BF29F for ; Fri, 15 Apr 2016 17:08:05 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 58F57203A9 for ; Fri, 15 Apr 2016 17:08:04 +0000 (UTC) Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 7CD0820398 for ; Fri, 15 Apr 2016 17:08:03 +0000 (UTC) Received: from localhost ([::1]:37954 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ar7Du-0005SY-KC for patchwork-qemu-devel@patchwork.kernel.org; Fri, 15 Apr 2016 13:08:02 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:45716) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ar78n-0003jf-Gw for qemu-devel@nongnu.org; Fri, 15 Apr 2016 13:02:46 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ar78m-0003jw-NT for qemu-devel@nongnu.org; Fri, 15 Apr 2016 13:02:45 -0400 Received: from mx1.redhat.com ([209.132.183.28]:55649) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ar78k-0003hy-PB; Fri, 15 Apr 2016 13:02:42 -0400 Received: from int-mx11.intmail.prod.int.phx2.redhat.com (int-mx11.intmail.prod.int.phx2.redhat.com [10.5.11.24]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 3F04D81121; Fri, 15 Apr 2016 17:02:42 +0000 (UTC) Received: from noname.redhat.com (ovpn-116-83.ams2.redhat.com [10.36.116.83]) by int-mx11.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id u3FH2RWc018652; Fri, 15 Apr 2016 13:02:40 -0400 From: Kevin Wolf To: qemu-block@nongnu.org Date: Fri, 15 Apr 2016 19:02:10 +0200 Message-Id: <1460739742-5315-8-git-send-email-kwolf@redhat.com> In-Reply-To: <1460739742-5315-1-git-send-email-kwolf@redhat.com> References: <1460739742-5315-1-git-send-email-kwolf@redhat.com> X-Scanned-By: MIMEDefang 2.68 on 10.5.11.24 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 209.132.183.28 Subject: [Qemu-devel] [PULL 07/19] block/vpc: make checks on max table size a bit more lax X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: kwolf@redhat.com, qemu-devel@nongnu.org Errors-To: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Sender: "Qemu-devel" X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Jeff Cody The check on the max_table_size field not being larger than required is valid, and in accordance with the VHD spec. However, there have been VHD images encountered in the wild that have an out-of-spec max table size that is technically too large. There is no issue in allowing this larger table size, as we also later verify that the computed size (used for the pagetable) is large enough to fit all sectors. In addition, max_table_entries is bounds checked against SIZE_MAX and INT_MAX. Remove the strict check, so that we can accomodate these sorts of images that are benignly out of spec. Reported-by: Stefan Hajnoczi Reported-by: Grant Wu Signed-off-by: Jeff Cody Reviewed-by: Stefan Hajnoczi Signed-off-by: Kevin Wolf --- block/vpc.c | 4 ---- 1 file changed, 4 deletions(-) diff --git a/block/vpc.c b/block/vpc.c index 03aee81..0eef099 100644 --- a/block/vpc.c +++ b/block/vpc.c @@ -351,10 +351,6 @@ static int vpc_open(BlockDriverState *bs, QDict *options, int flags, ret = -EINVAL; goto fail; } - if (s->max_table_entries > (VHD_MAX_SECTORS * 512) / s->block_size) { - ret = -EINVAL; - goto fail; - } computed_size = (uint64_t) s->max_table_entries * s->block_size; if (computed_size < bs->total_sectors * 512) {