[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Stable-8.1.4 14/31] vmdk: Don't corrupt desc file in vmdk_write_cid
From: |
Michael Tokarev |
Subject: |
[Stable-8.1.4 14/31] vmdk: Don't corrupt desc file in vmdk_write_cid |
Date: |
Tue, 12 Dec 2023 15:18:02 +0300 |
From: Fam Zheng <fam@euphon.net>
If the text description file is larger than DESC_SIZE, we force the last
byte in the buffer to be 0 and write it out.
This results in a corruption.
Try to allocate a big buffer in this case.
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1923
Signed-off-by: Fam Zheng <fam@euphon.net>
Message-ID: <20231124115654.3239137-1-fam@euphon.net>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
(cherry picked from commit 9fb7b350ba9816ebca8a7614fec486fd4269ab2d)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
diff --git a/block/vmdk.c b/block/vmdk.c
index 70066c2b01..58815dcef0 100644
--- a/block/vmdk.c
+++ b/block/vmdk.c
@@ -347,29 +347,41 @@ vmdk_write_cid(BlockDriverState *bs, uint32_t cid)
BDRVVmdkState *s = bs->opaque;
int ret = 0;
- desc = g_malloc0(DESC_SIZE);
- tmp_desc = g_malloc0(DESC_SIZE);
- ret = bdrv_co_pread(bs->file, s->desc_offset, DESC_SIZE, desc, 0);
+ size_t desc_buf_size;
+
+ if (s->desc_offset == 0) {
+ desc_buf_size = bdrv_getlength(bs->file->bs);
+ if (desc_buf_size > 16ULL << 20) {
+ error_report("VMDK description file too big");
+ return -EFBIG;
+ }
+ } else {
+ desc_buf_size = DESC_SIZE;
+ }
+
+ desc = g_malloc0(desc_buf_size);
+ tmp_desc = g_malloc0(desc_buf_size);
+ ret = bdrv_co_pread(bs->file, s->desc_offset, desc_buf_size, desc, 0);
if (ret < 0) {
goto out;
}
- desc[DESC_SIZE - 1] = '\0';
+ desc[desc_buf_size - 1] = '\0';
tmp_str = strstr(desc, "parentCID");
if (tmp_str == NULL) {
ret = -EINVAL;
goto out;
}
- pstrcpy(tmp_desc, DESC_SIZE, tmp_str);
+ pstrcpy(tmp_desc, desc_buf_size, tmp_str);
p_name = strstr(desc, "CID");
if (p_name != NULL) {
p_name += sizeof("CID");
- snprintf(p_name, DESC_SIZE - (p_name - desc), "%" PRIx32 "\n", cid);
- pstrcat(desc, DESC_SIZE, tmp_desc);
+ snprintf(p_name, desc_buf_size - (p_name - desc), "%" PRIx32 "\n",
cid);
+ pstrcat(desc, desc_buf_size, tmp_desc);
}
- ret = bdrv_co_pwrite_sync(bs->file, s->desc_offset, DESC_SIZE, desc, 0);
+ ret = bdrv_co_pwrite_sync(bs->file, s->desc_offset, desc_buf_size, desc,
0);
out:
g_free(desc);
diff --git a/tests/qemu-iotests/059 b/tests/qemu-iotests/059
index e8be217e1f..9bcf1e7525 100755
--- a/tests/qemu-iotests/059
+++ b/tests/qemu-iotests/059
@@ -84,6 +84,8 @@ echo
echo "=== Testing big twoGbMaxExtentFlat ==="
_make_test_img -o "subformat=twoGbMaxExtentFlat" 1000G
_img_info --format-specific | _filter_img_info --format-specific
+$QEMU_IO -c "write 990G 512 -P 89" "$TEST_IMG" | _filter_qemu_io
+$QEMU_IO -c "read 990G 512 -P 89" "$TEST_IMG" | _filter_qemu_io
_cleanup_test_img
echo
diff --git a/tests/qemu-iotests/059.out b/tests/qemu-iotests/059.out
index 2b83c0c8b6..275ee7c778 100644
--- a/tests/qemu-iotests/059.out
+++ b/tests/qemu-iotests/059.out
@@ -2032,6 +2032,10 @@ Format specific information:
virtual size: 2147483648
filename: TEST_DIR/t-f500.IMGFMT
format: FLAT
+wrote 512/512 bytes at offset 1063004405760
+512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+read 512/512 bytes at offset 1063004405760
+512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
=== Testing malformed VMFS extent description line ===
qemu-img: Could not open 'TEST_DIR/t.IMGFMT': Invalid extent line: RW 12582912
VMFS "dummy.IMGFMT" 1
--
2.39.2
- [Stable-8.1.4 04/31] net: Provide MemReentrancyGuard * to qemu_new_nic(), (continued)
- [Stable-8.1.4 04/31] net: Provide MemReentrancyGuard * to qemu_new_nic(), Michael Tokarev, 2023/12/12
- [Stable-8.1.4 06/31] linux-user: Fix loaddr computation for some elf files, Michael Tokarev, 2023/12/12
- [Stable-8.1.4 07/31] tests/avocado: Replace assertEquals() for Python 3.12 compatibility, Michael Tokarev, 2023/12/12
- [Stable-8.1.4 08/31] tests/avocado: Replace assertRegexpMatches() for Python 3.12 compatibility, Michael Tokarev, 2023/12/12
- [Stable-8.1.4 05/31] net: Update MemReentrancyGuard for NIC, Michael Tokarev, 2023/12/12
- [Stable-8.1.4 09/31] linux-user/riscv: Add Zicboz block size to hwprobe, Michael Tokarev, 2023/12/12
- [Stable-8.1.4 10/31] hw/riscv/virt.c: do create_fdt() earlier, add finalize_fdt(), Michael Tokarev, 2023/12/12
- [Stable-8.1.4 11/31] riscv: Fix SiFive E CLINT clock frequency, Michael Tokarev, 2023/12/12
- [Stable-8.1.4 12/31] target/riscv/cpu_helper.c: Invalid exception on MMU translation stage, Michael Tokarev, 2023/12/12
- [Stable-8.1.4 13/31] target/riscv/cpu_helper.c: Fix mxr bit behavior, Michael Tokarev, 2023/12/12
- [Stable-8.1.4 14/31] vmdk: Don't corrupt desc file in vmdk_write_cid,
Michael Tokarev <=
- [Stable-8.1.4 15/31] target/arm: Set IL bit for pauth, SVE access, BTI trap syndromes, Michael Tokarev, 2023/12/12
- [Stable-8.1.4 16/31] target/arm: Handle overflow in calculation of next timer tick, Michael Tokarev, 2023/12/12
- [Stable-8.1.4 17/31] hw/virtio: Free VirtIOIOMMUPCI::vdev.reserved_regions[] on finalize(), Michael Tokarev, 2023/12/12
- [Stable-8.1.4 18/31] hw/misc/mps2-scc: Free MPS2SCC::oscclk[] array on finalize(), Michael Tokarev, 2023/12/12
- [Stable-8.1.4 19/31] hw/nvram/xlnx-efuse: Free XlnxEFuse::ro_bits[] array on finalize(), Michael Tokarev, 2023/12/12
- [Stable-8.1.4 22/31] hw/avr/atmega: Fix wrong initial value of stack pointer, Michael Tokarev, 2023/12/12
- [Stable-8.1.4 21/31] hw/virtio: Add VirtioPCIDeviceTypeInfo::instance_finalize field, Michael Tokarev, 2023/12/12
- [Stable-8.1.4 20/31] hw/nvram/xlnx-efuse-ctrl: Free XlnxVersalEFuseCtrl[] "pg0-lock" array, Michael Tokarev, 2023/12/12
- [Stable-8.1.4 23/31] hw/audio/hda-codec: fix multiplication overflow, Michael Tokarev, 2023/12/12