SYS-OSS/FRET-qemu
4
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

parallels: fix possible int overflow

Browse Source 
The sum "cluster_index + count" may overflow uint32_t.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Signed-off-by: Dmitry Frolov <frolov@swemel.ru>
Message-ID: <20241106080521.219255-2-frolov@swemel.ru>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
This commit is contained in:
Dmitry Frolov 2024-11-06 11:04:36 +03:00 committed by Kevin Wolf
parent 6b99bb046d
commit b62e82be06
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
block/parallels.c
View File

@ -184,11 +184,11 @@ static int mark_used(BlockDriverState *bs, unsigned long *bitmap,
BDRVParallelsState *s = bs->opaque; BDRVParallelsState *s = bs->opaque;
uint32_t cluster_index = host_cluster_index(s, off); uint32_t cluster_index = host_cluster_index(s, off);
unsigned long next_used; unsigned long next_used;
if (cluster_index + count > bitmap_size) { if ((uint64_t)cluster_index + count > bitmap_size) {
return -E2BIG; return -E2BIG;
} }
next_used = find_next_bit(bitmap, bitmap_size, cluster_index); next_used = find_next_bit(bitmap, bitmap_size, cluster_index);
if (next_used < cluster_index + count) { if (next_used < (uint64_t)cluster_index + count) {
return -EBUSY; return -EBUSY;
} }
bitmap_set(bitmap, cluster_index, count); bitmap_set(bitmap, cluster_index, count);