Callers of bdrv_is_allocated() may go beyond the end of the image. For
general robustness we should limit to the end of the image so that
callers don't end up using out-of-range sector counts and receive -EIO.
This fix will allow the image streaming to terminate successfully.
Signed-off-by: Stefan Hajnoczi <stefa...@linux.vnet.ibm.com>
---
block/qed-cluster.c | 3 +++
1 files changed, 3 insertions(+), 0 deletions(-)
diff --git a/block/qed-cluster.c b/block/qed-cluster.c
index f64b2af..4632b32 100644
--- a/block/qed-cluster.c
+++ b/block/qed-cluster.c
@@ -142,6 +142,9 @@ void qed_find_cluster(BDRVQEDState *s, QEDRequest *request,
uint64_t pos,
*/
len = MIN(len, (((pos >> s->l1_shift) + 1) << s->l1_shift) - pos);
+ /* Limit length to image size */
+ len = MIN(len, s->header.image_size - pos);
+
l2_offset = s->l1_table->offsets[qed_l1_index(s, pos)];
if (qed_offset_is_unalloc_cluster(l2_offset)) {
cb(opaque, QED_CLUSTER_L1, 0, len);
--
1.7.7.3
