From: Kevin Wolf <kwolf@redhat.com>
Date: Fri, 8 May 2009 12:47:24 +0000 (+0200)
Subject: Improve block range checks
X-Git-Tag: v0.10.4~1
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=9fd0e57dc9d5601d5d62366639e593b9bd1d0b24;p=thirdparty%2Fqemu.git

Improve block range checks

This patch makes the range checks for block requests more strict: It fixes a
potential integer overflow and checks for negative offsets. Also, it adds the
check for compressed writes.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
---

diff --git a/block.c b/block.c
index 465a09f9bd3..b12318fe28b 100644
--- a/block.c
+++ b/block.c
@@ -533,7 +533,10 @@ static int bdrv_check_byte_request(BlockDriverState *bs, int64_t offset,
 
     len = bdrv_getlength(bs);
 
-    if ((offset + size) > len)
+    if (offset < 0)
+        return -EIO;
+
+    if ((offset > len) || (len - offset < size))
         return -EIO;
 
     return 0;
@@ -1170,6 +1173,8 @@ int bdrv_write_compressed(BlockDriverState *bs, int64_t sector_num,
         return -ENOMEDIUM;
     if (!drv->bdrv_write_compressed)
         return -ENOTSUP;
+    if (bdrv_check_request(bs, sector_num, nb_sectors))
+        return -EIO;
     return drv->bdrv_write_compressed(bs, sector_num, buf, nb_sectors);
 }