block: vpc - prevent overflow if max_table_entries >= 0x40000000
commitb15deac79530d818092cb49a8021bcce83d71b5b
authorJeff Cody <jcody@redhat.com>
Fri, 24 Jul 2015 14:26:51 +0000 (24 10:26 -0400)
committerKevin Wolf <kwolf@redhat.com>
Mon, 27 Jul 2015 15:19:06 +0000 (27 17:19 +0200)
tree65ff5ca823d26ff8b4ef17df58186eb09cb0a01e
parent122e7dab8ac549c8c5a9e1e13aa2464190e888de
block: vpc - prevent overflow if max_table_entries >= 0x40000000

When we allocate the pagetable based on max_table_entries, we multiply
the max table entry value by 4 to accomodate a table of 32-bit integers.
However, max_table_entries is a uint32_t, and the VPC driver accepts
ranges for that entry over 0x40000000.  So during this allocation:

s->pagetable = qemu_try_blockalign(bs->file, s->max_table_entries * 4);

The size arg overflows, allocating significantly less memory than
expected.

Since qemu_try_blockalign() size argument is size_t, cast the
multiplication correctly to prevent overflow.

The value of "max_table_entries * 4" is used elsewhere in the code as
well, so store the correct value for use in all those cases.

We also check the Max Tables Entries value, to make sure that it is <
SIZE_MAX / 4, so we know the pagetable size will fit in size_t.

Cc: qemu-stable@nongnu.org
Reported-by: Richard W.M. Jones <rjones@redhat.com>
Signed-off-by: Jeff Cody <jcody@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
block/vpc.c