diff options
| author | Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> | 2020-12-11 21:39:21 +0300 |
|---|---|---|
| committer | Eric Blake <eblake@redhat.com> | 2021-02-03 08:00:33 -0600 |
| commit | a56ed80c429610aecd6f74fbd4a9467f5466278a (patch) | |
| tree | 0e15ac7e2d6d667282288ee1085cecaa99c4ff21 | |
| parent | 4c002cef0e9abe7135d7916c51abce47f7fc1ee2 (diff) | |
block: fix theoretical overflow in bdrv_init_padding()
Calculation of sum may theoretically overflow, so use 64bit type and
add some good assertions.
Use int64_t constantly.
Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Message-Id: <20201211183934.169161-4-vsementsov@virtuozzo.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
[eblake: tweak assertion order]
Signed-off-by: Eric Blake <eblake@redhat.com>
| -rw-r--r-- | block/io.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/block/io.c b/block/io.c index ab953bd58f..c8c9dea554 100644 --- a/block/io.c +++ b/block/io.c @@ -1565,8 +1565,12 @@ static bool bdrv_init_padding(BlockDriverState *bs, int64_t offset, int64_t bytes, BdrvRequestPadding *pad) { - uint64_t align = bs->bl.request_alignment; - size_t sum; + int64_t align = bs->bl.request_alignment; + int64_t sum; + + bdrv_check_request(offset, bytes, &error_abort); + assert(align <= INT_MAX); /* documented in block/block_int.h */ + assert(align <= SIZE_MAX / 2); /* so we can allocate the buffer */ memset(pad, 0, sizeof(*pad)); |