From patchwork Mon Mar 26 14:35:55 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kevin Wolf X-Patchwork-Id: 10308039 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 3076A600CC for ; Mon, 26 Mar 2018 14:52:38 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 1C758296AF for ; Mon, 26 Mar 2018 14:52:38 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 115FF296C9; Mon, 26 Mar 2018 14:52:38 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 53E8F296C7 for ; Mon, 26 Mar 2018 14:52:35 +0000 (UTC) Received: from localhost ([::1]:57166 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1f0TUA-000190-Rc for patchwork-qemu-devel@patchwork.kernel.org; Mon, 26 Mar 2018 10:52:34 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:45608) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1f0TEX-00038j-35 for qemu-devel@nongnu.org; Mon, 26 Mar 2018 10:36:30 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1f0TEW-0004EX-3w for qemu-devel@nongnu.org; Mon, 26 Mar 2018 10:36:25 -0400 Received: from mx3-rdu2.redhat.com ([66.187.233.73]:47470 helo=mx1.redhat.com) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1f0TEQ-00041J-HN; Mon, 26 Mar 2018 10:36:18 -0400 Received: from smtp.corp.redhat.com (int-mx05.intmail.prod.int.rdu2.redhat.com [10.11.54.5]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 1A5CA4068056; Mon, 26 Mar 2018 14:36:18 +0000 (UTC) Received: from localhost.localdomain.com (unknown [10.36.118.75]) by smtp.corp.redhat.com (Postfix) with ESMTP id 68FAE7C2D; Mon, 26 Mar 2018 14:36:17 +0000 (UTC) From: Kevin Wolf To: qemu-block@nongnu.org Date: Mon, 26 Mar 2018 16:35:55 +0200 Message-Id: <20180326143600.7724-15-kwolf@redhat.com> In-Reply-To: <20180326143600.7724-1-kwolf@redhat.com> References: <20180326143600.7724-1-kwolf@redhat.com> X-Scanned-By: MIMEDefang 2.79 on 10.11.54.5 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.11.55.5]); Mon, 26 Mar 2018 14:36:18 +0000 (UTC) X-Greylist: inspected by milter-greylist-4.5.16 (mx1.redhat.com [10.11.55.5]); Mon, 26 Mar 2018 14:36:18 +0000 (UTC) for IP:'10.11.54.5' DOMAIN:'int-mx05.intmail.prod.int.rdu2.redhat.com' HELO:'smtp.corp.redhat.com' FROM:'kwolf@redhat.com' RCPT:'' X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 66.187.233.73 Subject: [Qemu-devel] [PULL 14/19] parallels: Check maximum cluster size on create X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: kwolf@redhat.com, qemu-devel@nongnu.org Errors-To: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Sender: "Qemu-devel" X-Virus-Scanned: ClamAV using ClamSMTP It's unclear what the real maximum cluster size is for the Parallels format, but let's at least make sure that we don't get integer overflows in our .bdrv_co_create implementation. Signed-off-by: Kevin Wolf Reviewed-by: Eric Blake --- block/parallels.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/block/parallels.c b/block/parallels.c index e2515dec81..799215e079 100644 --- a/block/parallels.c +++ b/block/parallels.c @@ -526,6 +526,11 @@ static int coroutine_fn parallels_co_create(BlockdevCreateOptions* opts, cl_size = DEFAULT_CLUSTER_SIZE; } + /* XXX What is the real limit here? This is an insanely large maximum. */ + if (cl_size >= INT64_MAX / MAX_PARALLELS_IMAGE_FACTOR) { + error_setg(errp, "Cluster size is too large"); + return -EINVAL; + } if (total_size >= MAX_PARALLELS_IMAGE_FACTOR * cl_size) { error_setg(errp, "Image size is too large for this cluster size"); return -E2BIG;