From: Kevin Wolf <kw...@redhat.com>
32 bit truncation could let us access the wrong offset in the image.
Signed-off-by: Kevin Wolf <kw...@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefa...@redhat.com>
Reviewed-by: Max Reitz <mre...@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefa...@redhat.com>
(cherry picked from commit a9ba36a45dfac645a810c31ce15ab393b69d820a)
Signed-off-by: Michael Roth <mdr...@linux.vnet.ibm.com>
---
block/bochs.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/block/bochs.c b/block/bochs.c
index 0ec980a..5c74223 100644
--- a/block/bochs.c
+++ b/block/bochs.c
@@ -185,8 +185,9 @@ static int64_t seek_to_sector(BlockDriverState *bs, int64_t
sector_num)
return -1; /* not allocated */
}
- bitmap_offset = s->data_offset + (512 * s->catalog_bitmap[extent_index] *
- (s->extent_blocks + s->bitmap_blocks));
+ bitmap_offset = s->data_offset +
+ (512 * (uint64_t) s->catalog_bitmap[extent_index] *
+ (s->extent_blocks + s->bitmap_blocks));
/* read in bitmap for current extent */
if (bdrv_pread(bs->file, bitmap_offset + (extent_offset / 8),
--
1.9.1
