On 26.03.2014 13:05, Stefan Hajnoczi wrote:
cloop stores the number of compressed blocks in the n_blocks header field. The file actually contains n_blocks + 1 offsets, where the extra offset is the end-of-file offset.The following line in cloop_read_block() results in an out-of-bounds offsets[] access: uint32_t bytes = s->offsets[block_num + 1] - s->offsets[block_num]; This patch allocates and loads the extra offset so that cloop_read_block() works correctly when the last block is accessed. Notice that we must free s->offsets[] unconditionally now since there is always an end-of-file offset. Signed-off-by: Stefan Hajnoczi <stefa...@redhat.com> Signed-off-by: Kevin Wolf <kw...@redhat.com> --- block/cloop.c | 12 +++++------- tests/qemu-iotests/075 | 5 +++++ tests/qemu-iotests/075.out | 4 ++++ 3 files changed, 14 insertions(+), 7 deletions(-)
Reviewed-by: Max Reitz <mre...@redhat.com>
