qcow2: fix offset overflow in qcow2_alloc_clusters_at()
commit33304ec9fa484e765c6249673e09e1b7d49c5b85
authorHu Tao <hutao@cn.fujitsu.com>
Sun, 26 Jan 2014 03:12:38 +0000 (26 11:12 +0800)
committerKevin Wolf <kwolf@redhat.com>
Sun, 9 Feb 2014 08:12:39 +0000 (9 09:12 +0100)
tree9e469f03b22e55233921b39cb9c6ec765dceb293
parent16f0587e0a5da5b1ad76cb7c3739491bc042201c
qcow2: fix offset overflow in qcow2_alloc_clusters_at()

When cluster size is big enough it can lead to an offset overflow
in qcow2_alloc_clusters_at(). This patch fixes it.

The allocation is stopped each time at L2 table boundary
(see handle_alloc()), so the possible maximum bytes could be

  2^(cluster_bits - 3 + cluster_bits)

cluster_bits - 3 is used to compute the number of entry by L2
and the additional cluster_bits is to take into account each
clusters referenced by the L2 entries.

so int is safe for cluster_bits<=17, unsafe otherwise.

Signed-off-by: Hu Tao <hutao@cn.fujitsu.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Benoit Canet <benoit@irqsave.net>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
block/qcow2-refcount.c