From 8c20718dab7f1612dcc40fe478642cbc1102aa9b Mon Sep 17 00:00:00 2001 From: Kevin Wolf Date: Fri, 8 May 2009 14:47:24 +0200 Subject: [PATCH] Improve block range checks This patch makes the range checks for block requests more strict: It fixes a potential integer overflow and checks for negative offsets. Also, it adds the check for compressed writes. Signed-off-by: Kevin Wolf Signed-off-by: Anthony Liguori (cherry picked from commit fbb7b4e0804d2168f24142eebf7552adde1968dc) --- block.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/block.c b/block.c index 3261225f..69c6da55 100644 --- a/block.c +++ b/block.c @@ -559,7 +559,10 @@ static int bdrv_check_byte_request(BlockDriverState *bs, int64_t offset, len = bdrv_getlength(bs); - if ((offset + size) > len) + if (offset < 0) + return -EIO; + + if ((offset > len) || (len - offset < size)) return -EIO; return 0; @@ -1209,6 +1212,8 @@ int bdrv_write_compressed(BlockDriverState *bs, int64_t sector_num, return -EIO; if (!drv->bdrv_write_compressed) return -ENOTSUP; + if (bdrv_check_request(bs, sector_num, nb_sectors)) + return -EIO; return drv->bdrv_write_compressed(bs, sector_num, buf, nb_sectors); } -- 2.39.5