Message ID | 20250318101933.255617-1-gerben@altlinux.org (mailing list archive) |
---|---|
State | New |
Headers | show |
Series | qemu-img: fix division by zero in bench_cb() for zero-sized images | expand |
Am 18.03.2025 um 11:19 hat gerben@altlinux.org geschrieben: > From: Denis Rastyogin <gerben@altlinux.org> > > This error was discovered by fuzzing qemu-img. > > This commit fixes a division by zero error in the bench_cb() function > that occurs when using the bench command with a zero-sized image. > > The issue arises because b->image_size can be zero, leading to a > division by zero in the modulo operation (b->offset %= b->image_size). > This patch adds a check for b->image_size == 0 and resets b->offset > to 0 in such cases, preventing the error. > > Signed-off-by: Denis Rastyogin <gerben@altlinux.org> Thanks, applied to the block branch. Kevin
diff --git a/qemu-img.c b/qemu-img.c index 89c93c1eb5..2044c22a4c 100644 --- a/qemu-img.c +++ b/qemu-img.c @@ -4488,7 +4488,11 @@ static void bench_cb(void *opaque, int ret) */ b->in_flight++; b->offset += b->step; - b->offset %= b->image_size; + if (b->image_size == 0) { + b->offset = 0; + } else { + b->offset %= b->image_size; + } if (b->write) { acb = blk_aio_pwritev(b->blk, offset, b->qiov, 0, bench_cb, b); } else {