• Denis V. Lunev's avatar
    block/parallels: fix access to not initialized memory in catalog_bitmap · da725d0b
    Denis V. Lunev authored
    found by valgrind.
    Command: ./qemu-img convert -f parallels -O qcow2 1.hds 1.img
    Invalid read of size 4
       at 0x17D0EF: parallels_co_read (parallels.c:357)
       by 0x11FEE4: bdrv_aio_rw_vector (block.c:4640)
       by 0x11FFBF: bdrv_aio_readv_em (block.c:4652)
       by 0x11F55F: bdrv_co_readv_em (block.c:4862)
       by 0x123428: bdrv_aligned_preadv (block.c:3056)
       by 0x1239FA: bdrv_co_do_preadv (block.c:3162)
       by 0x125424: bdrv_rw_co_entry (block.c:2706)
       by 0x155DD9: coroutine_trampoline (coroutine-ucontext.c:118)
       by 0x6975B6F: ??? (in /lib/x86_64-linux-gnu/libc-2.19.so)
    The problem is that s->catalog_bitmap is allocated/filled as
    gmalloc(s->catalog_size) thus index validity check must be
    inclusive, i.e. index >= s->catalog_size is invalid.
    Signed-off-by: default avatarDenis V. Lunev <den@openvz.org>
    Reviewed-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
    Message-id: 1412759610-2257-4-git-send-email-den@openvz.org
    CC: Jeff Cody <jcody@redhat.com>
    CC: Kevin Wolf <kwolf@redhat.com>
    CC: Stefan Hajnoczi <stefanha@redhat.com>
    Signed-off-by: default avatarStefan Hajnoczi <stefanha@redhat.com>
parallels.c 5.93 KB