diff options
| author | Stefan Hajnoczi <stefanha@redhat.com> | 2014-03-26 13:05:29 +0100 |
|---|---|---|
| committer | Stefan Hajnoczi <stefanha@redhat.com> | 2014-04-01 13:59:47 +0200 |
| commit | 42d43d35d907579179a39c924d169da924786f65 (patch) | |
| tree | c9e41f9e7b7796ea29cb12d242228cc6062e579b /qemu-coroutine-io.c | |
| parent | f56b9bc3ae20fc93815b34aa022be919941406ce (diff) | |
block/cloop: fix offsets[] size off-by-one
cloop stores the number of compressed blocks in the n_blocks header
field. The file actually contains n_blocks + 1 offsets, where the extra
offset is the end-of-file offset.
The following line in cloop_read_block() results in an out-of-bounds
offsets[] access:
uint32_t bytes = s->offsets[block_num + 1] - s->offsets[block_num];
This patch allocates and loads the extra offset so that
cloop_read_block() works correctly when the last block is accessed.
Notice that we must free s->offsets[] unconditionally now since there is
always an end-of-file offset.
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Diffstat (limited to 'qemu-coroutine-io.c')
0 files changed, 0 insertions, 0 deletions