diff options
| author | Dmitry Frolov <frolov@swemel.ru> | 2024-11-06 11:04:36 +0300 |
|---|---|---|
| committer | Kevin Wolf <kwolf@redhat.com> | 2024-11-25 11:03:14 +0100 |
| commit | b62e82be06a97ce48d1363bb28e8215ab2487a20 (patch) | |
| tree | 5ad23d831d72a4730447af4a37f4b4556ca2325d | |
| parent | 6b99bb046dd36a6dd5525b8f88c2dcddae49222a (diff) | |
parallels: fix possible int overflow
The sum "cluster_index + count" may overflow uint32_t.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Signed-off-by: Dmitry Frolov <frolov@swemel.ru>
Message-ID: <20241106080521.219255-2-frolov@swemel.ru>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
| -rw-r--r-- | block/parallels.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/block/parallels.c b/block/parallels.c index 9205a0864f..071b6dcaf8 100644 --- a/block/parallels.c +++ b/block/parallels.c @@ -184,11 +184,11 @@ static int mark_used(BlockDriverState *bs, unsigned long *bitmap, BDRVParallelsState *s = bs->opaque; uint32_t cluster_index = host_cluster_index(s, off); unsigned long next_used; - if (cluster_index + count > bitmap_size) { + if ((uint64_t)cluster_index + count > bitmap_size) { return -E2BIG; } next_used = find_next_bit(bitmap, bitmap_size, cluster_index); - if (next_used < cluster_index + count) { + if (next_used < (uint64_t)cluster_index + count) { return -EBUSY; } bitmap_set(bitmap, cluster_index, count); |