| Message ID | 20230701100759.261007-3-alexander.ivanov@virtuozzo.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | parallels: Add duplication check, repair at open, fix bugs | expand |
On 7/1/23 12:07, Alexander Ivanov wrote: > Initially data_end is set to the data_off image header field and must not be should be truncated to 74 symbols > greater than the file size. > > Signed-off-by: Alexander Ivanov <alexander.ivanov@virtuozzo.com> > --- > block/parallels.c | 5 +++++ > 1 file changed, 5 insertions(+) > > diff --git a/block/parallels.c b/block/parallels.c > index 86bc3bfcb8..40a26908db 100644 > --- a/block/parallels.c > +++ b/block/parallels.c > @@ -868,6 +868,11 @@ static int parallels_open(BlockDriverState *bs, QDict *options, int flags, > and actual data. We can't avoid read-modify-write... */ > s->header_size = size; > } > + if (s->data_end > file_nb_sectors) { > + error_setg(errp, "Invalid image: incorrect data_off field"); > + ret = -EINVAL; > + goto fail; > + } > > ret = bdrv_pread(bs->file, 0, s->header_size, s->header, 0); > if (ret < 0) { With comment line truncated to 74 chars: Reviewed-by: Denis V. Lunev <den@openvz.org>
diff --git a/block/parallels.c b/block/parallels.c index 86bc3bfcb8..40a26908db 100644 --- a/block/parallels.c +++ b/block/parallels.c @@ -868,6 +868,11 @@ static int parallels_open(BlockDriverState *bs, QDict *options, int flags, and actual data. We can't avoid read-modify-write... */ s->header_size = size; } + if (s->data_end > file_nb_sectors) { + error_setg(errp, "Invalid image: incorrect data_off field"); + ret = -EINVAL; + goto fail; + } ret = bdrv_pread(bs->file, 0, s->header_size, s->header, 0); if (ret < 0) {
Initially data_end is set to the data_off image header field and must not be greater than the file size. Signed-off-by: Alexander Ivanov <alexander.ivanov@virtuozzo.com> --- block/parallels.c | 5 +++++ 1 file changed, 5 insertions(+)