From 3f910692c287e1c611c00e763ebeb95ed0e017f8 Mon Sep 17 00:00:00 2001 From: Jeff Cody Date: Mon, 7 Aug 2017 08:38:19 -0400 Subject: block/vhdx: check error return of bdrv_getlength() Calls to bdrv_getlength() were not checking for error. In vhdx.c, this can lead to truncating an image file, so it is a definite bug. In vhdx-log.c, the path for improper behavior is less clear, but it is best to check in any case. Some minor code movement of the log_guid intialization, as well. Reported-by: Markus Armbruster Reviewed-by: Eric Blake Signed-off-by: Jeff Cody Signed-off-by: Kevin Wolf --- block/vhdx.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) (limited to 'block/vhdx.c') diff --git a/block/vhdx.c b/block/vhdx.c index a9cecd2773..37224b8858 100644 --- a/block/vhdx.c +++ b/block/vhdx.c @@ -1166,7 +1166,14 @@ exit: static int vhdx_allocate_block(BlockDriverState *bs, BDRVVHDXState *s, uint64_t *new_offset) { - *new_offset = bdrv_getlength(bs->file->bs); + int64_t current_len; + + current_len = bdrv_getlength(bs->file->bs); + if (current_len < 0) { + return current_len; + } + + *new_offset = current_len; /* per the spec, the address for a block is in units of 1MB */ *new_offset = ROUND_UP(*new_offset, 1024 * 1024); -- cgit v1.2.3