|
 |
0a122b |
From faa093fc3b71b073a73f800785c3cdabe5a91cc3 Mon Sep 17 00:00:00 2001
|
|
|
0a122b |
From: Kevin Wolf <kwolf@redhat.com>
|
|
|
0a122b |
Date: Tue, 25 Mar 2014 14:23:21 +0100
|
|
|
0a122b |
Subject: [PATCH 14/49] bochs: Fix bitmap offset calculation
|
|
|
0a122b |
|
|
|
0a122b |
RH-Author: Kevin Wolf <kwolf@redhat.com>
|
|
|
0a122b |
Message-id: <1395753835-7591-15-git-send-email-kwolf@redhat.com>
|
|
|
0a122b |
Patchwork-id: n/a
|
|
|
0a122b |
O-Subject: [virt-devel] [EMBARGOED RHEL-7.0 qemu-kvm PATCH 14/48] bochs: Fix bitmap offset calculation
|
|
|
0a122b |
Bugzilla: 1066691
|
|
|
0a122b |
RH-Acked-by: Jeff Cody <jcody@redhat.com>
|
|
|
0a122b |
RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
|
|
|
0a122b |
RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
|
|
|
0a122b |
|
|
|
0a122b |
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1066691
|
|
|
0a122b |
Upstream status: Series embargoed
|
|
|
0a122b |
|
|
|
0a122b |
32 bit truncation could let us access the wrong offset in the image.
|
|
|
0a122b |
|
|
|
0a122b |
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
|
|
|
0a122b |
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
|
|
|
0a122b |
---
|
|
|
0a122b |
block/bochs.c | 5 +++--
|
|
|
0a122b |
1 files changed, 3 insertions(+), 2 deletions(-)
|
|
|
0a122b |
|
|
|
0a122b |
diff --git a/block/bochs.c b/block/bochs.c
|
|
|
0a122b |
index 0ec980a..5c74223 100644
|
|
|
0a122b |
--- a/block/bochs.c
|
|
|
0a122b |
+++ b/block/bochs.c
|
|
|
0a122b |
@@ -185,8 +185,9 @@ static int64_t seek_to_sector(BlockDriverState *bs, int64_t sector_num)
|
|
|
0a122b |
return -1; /* not allocated */
|
|
|
0a122b |
}
|
|
|
0a122b |
|
|
|
0a122b |
- bitmap_offset = s->data_offset + (512 * s->catalog_bitmap[extent_index] *
|
|
|
0a122b |
- (s->extent_blocks + s->bitmap_blocks));
|
|
|
0a122b |
+ bitmap_offset = s->data_offset +
|
|
|
0a122b |
+ (512 * (uint64_t) s->catalog_bitmap[extent_index] *
|
|
|
0a122b |
+ (s->extent_blocks + s->bitmap_blocks));
|
|
|
0a122b |
|
|
|
0a122b |
/* read in bitmap for current extent */
|
|
|
0a122b |
if (bdrv_pread(bs->file, bitmap_offset + (extent_offset / 8),
|
|
|
0a122b |
--
|
|
|
0a122b |
1.7.1
|
|
|
0a122b |
|