| Message ID | 20230621082010.139195-3-alexander.ivanov@virtuozzo.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | parallels: Add duplication check, repair at open, fix bugs | expand |
On 6/21/23 10:20, Alexander Ivanov wrote: > Initially data_end is set to the data_off image header field and must not be > greater than the file size. > > Signed-off-by: Alexander Ivanov <alexander.ivanov@virtuozzo.com> > --- > block/parallels.c | 5 +++++ > 1 file changed, 5 insertions(+) > > diff --git a/block/parallels.c b/block/parallels.c > index 1ec98c722b..4b7eafba1e 100644 > --- a/block/parallels.c > +++ b/block/parallels.c > @@ -868,6 +868,11 @@ static int parallels_open(BlockDriverState *bs, QDict *options, int flags, > and actual data. We can't avoid read-modify-write... */ > s->header_size = size; > } > + if (s->data_end > file_nb_sectors) { > + error_setg(errp, "Invalid image: incorrect data_off field"); > + ret = -EINVAL; > + goto fail; > + } > > ret = bdrv_pread(bs->file, 0, s->header_size, s->header, 0); > if (ret < 0) { for me this seems incorrect. In this case we would not be able to EVER open such image, even for a check purpose. This place should have a clause like if (!(flags & BDRV_O_CHECK)) { goto fail } This error is not fatal from the check point of view. Den
diff --git a/block/parallels.c b/block/parallels.c index 1ec98c722b..4b7eafba1e 100644 --- a/block/parallels.c +++ b/block/parallels.c @@ -868,6 +868,11 @@ static int parallels_open(BlockDriverState *bs, QDict *options, int flags, and actual data. We can't avoid read-modify-write... */ s->header_size = size; } + if (s->data_end > file_nb_sectors) { + error_setg(errp, "Invalid image: incorrect data_off field"); + ret = -EINVAL; + goto fail; + } ret = bdrv_pread(bs->file, 0, s->header_size, s->header, 0); if (ret < 0) {
Initially data_end is set to the data_off image header field and must not be greater than the file size. Signed-off-by: Alexander Ivanov <alexander.ivanov@virtuozzo.com> --- block/parallels.c | 5 +++++ 1 file changed, 5 insertions(+)