diff options
| author | Kevin Wolf <kwolf@redhat.com> | 2012-10-26 16:33:32 +0200 |
|---|---|---|
| committer | Kevin Wolf <kwolf@redhat.com> | 2012-11-14 18:19:21 +0100 |
| commit | a3548077062dd9dc2701ebffd931ba6eaef40bec (patch) | |
| tree | 910fe8f72cc51590b303e8cdebb73ddaf00a9c6a /block/qcow2-refcount.c | |
| parent | 8809e28937b8a48ff0dfeeb93498641392f26019 (diff) | |
qcow2: Fix refcount table size calculation
A missing factor for the refcount table entry size in the calculation
could mean that too little memory was allocated for the in-memory
representation of the table, resulting in a buffer overflow.
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Tested-by: Michael Tokarev <mjt@tls.msk.ru>
Diffstat (limited to 'block/qcow2-refcount.c')
| -rw-r--r-- | block/qcow2-refcount.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/block/qcow2-refcount.c b/block/qcow2-refcount.c index 5e3f9153fb..96224d1af2 100644 --- a/block/qcow2-refcount.c +++ b/block/qcow2-refcount.c @@ -301,7 +301,8 @@ static int alloc_refcount_block(BlockDriverState *bs, uint64_t last_table_size; uint64_t blocks_clusters; do { - uint64_t table_clusters = size_to_clusters(s, table_size); + uint64_t table_clusters = + size_to_clusters(s, table_size * sizeof(uint64_t)); blocks_clusters = 1 + ((table_clusters + refcount_block_clusters - 1) / refcount_block_clusters); |