|
 |
e427d2 |
From 1a97380b1cc4d167697e31e5fb663e805629c1ab Mon Sep 17 00:00:00 2001
|
|
|
e427d2 |
From: Artem Blagodarenko <artem.blagodarenko@gmail.com>
|
|
|
e427d2 |
Date: Thu, 22 Apr 2021 01:24:48 -0400
|
|
|
e427d2 |
Subject: [PATCH 25/46] e2image: fix overflow in l2 table processing
|
|
|
e427d2 |
Content-Type: text/plain
|
|
|
e427d2 |
|
|
|
e427d2 |
For a large partition during e2image capture process
|
|
|
e427d2 |
it is possible to overflow offset at multiply operation.
|
|
|
e427d2 |
This leads to the situation when data is written to the
|
|
|
e427d2 |
position at the start of the image instead of the image end.
|
|
|
e427d2 |
|
|
|
e427d2 |
Let's use the right cast to avoid integer overflow.
|
|
|
e427d2 |
|
|
|
e427d2 |
Signed-off-by: Alexey Lyashkov <c17817@cray.com>
|
|
|
e427d2 |
Signed-off-by: Artem Blagodarenko <c17828@cray.com>
|
|
|
e427d2 |
HPE-bug-id: LUS-9368
|
|
|
e427d2 |
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
|
|
|
e427d2 |
Signed-off-by: Lukas Czerner <lczerner@redhat.com>
|
|
|
e427d2 |
---
|
|
|
e427d2 |
lib/ext2fs/qcow2.c | 2 +-
|
|
|
e427d2 |
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
e427d2 |
|
|
|
e427d2 |
diff --git a/lib/ext2fs/qcow2.c b/lib/ext2fs/qcow2.c
|
|
|
e427d2 |
index ee701f7a..20824170 100644
|
|
|
e427d2 |
--- a/lib/ext2fs/qcow2.c
|
|
|
e427d2 |
+++ b/lib/ext2fs/qcow2.c
|
|
|
e427d2 |
@@ -238,7 +238,7 @@ int qcow2_write_raw_image(int qcow2_fd, int raw_fd,
|
|
|
e427d2 |
if (offset == 0)
|
|
|
e427d2 |
continue;
|
|
|
e427d2 |
|
|
|
e427d2 |
- off_out = (l1_index * img.l2_size) +
|
|
|
e427d2 |
+ off_out = ((__u64)l1_index * img.l2_size) +
|
|
|
e427d2 |
l2_index;
|
|
|
e427d2 |
off_out <<= img.cluster_bits;
|
|
|
e427d2 |
ret = qcow2_copy_data(qcow2_fd, raw_fd, offset,
|
|
|
e427d2 |
--
|
|
|
e427d2 |
2.35.1
|
|
|
e427d2 |
|