aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorKevin Wolf <kwolf@redhat.com>2009-05-08 14:47:24 +0200
committerAnthony Liguori <aliguori@us.ibm.com>2009-05-08 16:04:20 -0500
commit9fd0e57dc9d5601d5d62366639e593b9bd1d0b24 (patch)
tree9b8897d9ec516a25cfc8215194dc878c9b9c13e2
parent2fd0f9328634d0b156add2b4d7c10f7c193d2e20 (diff)
Improve block range checks
This patch makes the range checks for block requests more strict: It fixes a potential integer overflow and checks for negative offsets. Also, it adds the check for compressed writes. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
-rw-r--r--block.c7
1 files changed, 6 insertions, 1 deletions
diff --git a/block.c b/block.c
index 465a09f9bd..b12318fe28 100644
--- a/block.c
+++ b/block.c
@@ -533,7 +533,10 @@ static int bdrv_check_byte_request(BlockDriverState *bs, int64_t offset,
len = bdrv_getlength(bs);
- if ((offset + size) > len)
+ if (offset < 0)
+ return -EIO;
+
+ if ((offset > len) || (len - offset < size))
return -EIO;
return 0;
@@ -1170,6 +1173,8 @@ int bdrv_write_compressed(BlockDriverState *bs, int64_t sector_num,
return -ENOMEDIUM;
if (!drv->bdrv_write_compressed)
return -ENOTSUP;
+ if (bdrv_check_request(bs, sector_num, nb_sectors))
+ return -EIO;
return drv->bdrv_write_compressed(bs, sector_num, buf, nb_sectors);
}