[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH v2 1/8] parallels: Out of image offset in BAT leads to image infl
From: |
Alexander Ivanov |
Subject: |
[PATCH v2 1/8] parallels: Out of image offset in BAT leads to image inflation |
Date: |
Thu, 11 Aug 2022 17:00:37 +0200 |
When an image is opened, data_end field in BDRVParallelsState
is setted as the biggest offset in the BAT plus cluster size.
If there is a corrupted offset pointing outside the image,
the image size increase accordingly. It potentially leads
to attempts to create a file size of petabytes.
Set the data_end field with the original file size if the image
was opened for checking and repairing purposes or raise an error.
v2: No changes.
Signed-off-by: Alexander Ivanov <alexander.ivanov@virtuozzo.com>
---
block/parallels.c | 17 +++++++++++++++++
1 file changed, 17 insertions(+)
diff --git a/block/parallels.c b/block/parallels.c
index a229c06f25..a76cf9d993 100644
--- a/block/parallels.c
+++ b/block/parallels.c
@@ -732,6 +732,7 @@ static int parallels_open(BlockDriverState *bs, QDict
*options, int flags,
BDRVParallelsState *s = bs->opaque;
ParallelsHeader ph;
int ret, size, i;
+ int64_t file_size;
QemuOpts *opts = NULL;
Error *local_err = NULL;
char *buf;
@@ -811,6 +812,22 @@ static int parallels_open(BlockDriverState *bs, QDict
*options, int flags,
}
}
+ file_size = bdrv_getlength(bs->file->bs);
+ if (file_size < 0) {
+ goto fail;
+ }
+
+ file_size >>= BDRV_SECTOR_BITS;
+ if (s->data_end > file_size) {
+ if (flags & BDRV_O_CHECK) {
+ s->data_end = file_size;
+ } else {
+ error_setg(errp, "parallels: Offset in BAT is out of image");
+ ret = -EINVAL;
+ goto fail;
+ }
+ }
+
if (le32_to_cpu(ph.inuse) == HEADER_INUSE_MAGIC) {
/* Image was not closed correctly. The check is mandatory */
s->header_unclean = true;
--
2.34.1
- [PATCH v2 0/8] parallels: Refactor the code of images checks and fix a bug, Alexander Ivanov, 2022/08/11
- [PATCH v2 3/8] parallels: Replace bdrv_co_pwrite_sync by bdrv_co_flush for BAT flushing, Alexander Ivanov, 2022/08/11
- [PATCH v2 7/8] parallels: Move statistic collection to a separate function, Alexander Ivanov, 2022/08/11
- [PATCH v2 4/8] parallels: Move check of unclean image to a separate function, Alexander Ivanov, 2022/08/11
- [PATCH v2 8/8] parallels: Replace qemu_co_mutex_lock by WITH_QEMU_LOCK_GUARD, Alexander Ivanov, 2022/08/11
- [PATCH v2 1/8] parallels: Out of image offset in BAT leads to image inflation,
Alexander Ivanov <=
- [PATCH v2 5/8] parallels: Move check of cluster outside image to a separate function, Alexander Ivanov, 2022/08/11
- [PATCH v2 6/8] parallels: Move check of leaks to a separate function, Alexander Ivanov, 2022/08/11
- [PATCH v2 2/8] parallels: Move BAT entry setting to a separate function, Alexander Ivanov, 2022/08/11
- Re: [PATCH v2 0/8] parallels: Refactor the code of images checks and fix a bug, Denis V. Lunev, 2022/08/12