On 08/31/2018 11:36 AM, Liam Merwick wrote:
The commit for 0e4e4318eaa5 increments QCOW2_OL_MAX_BITNR but does not add an array entry for QCOW2_OL_BITMAP_DIRECTORY_BITNR to metadata_ol_names[]. As a result, an array dereference of metadata_ol_names[8] in qcow2_pre_write_overlap_check() could result in a read outside of the array bounds.Fixes: 0e4e4318eaa5 ('qcow2: add overlap check for bitmap directory') Cc: Vladimir Sementsov-Ogievskiy <vsement...@virtuozzo.com> Signed-off-by: Liam Merwick <liam.merw...@oracle.com> --- block/qcow2-refcount.c | 26 ++++++++++++++++++-------- 1 file changed, 18 insertions(+), 8 deletions(-)
+ +/* + * Catch at compile time the case where an overlap detection bit + * was added to QCow2MetadataOverlap in block/qcow2.h but a + * corresponding entry to metadata_ol_names[] wasn't added. + */
I'm not sure the comment adds much value. I'd be fine with dropping it.
+QEMU_BUILD_BUG_ON(QCOW2_OL_MAX_BITNR != + (sizeof(metadata_ol_names) / sizeof(metadata_ol_names[0])));
We have a macro for that. Spell this: QEMU_BUILD_BUG_ON(QCOW2_OL_MAX_BITNR != ARRAY_SIZE(metadata_ol_names)); and then you can have Reviewed-by: Eric Blake <ebl...@redhat.com> -- Eric Blake, Principal Software Engineer Red Hat, Inc. +1-919-301-3266 Virtualization: qemu.org | libvirt.org
