From 54456cc0fd3590ae9d1d4a74161eb9aa76d66710 Mon Sep 17 00:00:00 2001 From: Eric Blake Date: Thu, 2 Jun 2011 17:52:16 -0600 Subject: [PATCH] storage: avoid mishandling backing store > 2GB Detected by Coverity. The code was doing math on shifted unsigned char (which promotes to int), then promoting that to unsigned long during assignment to size. On 64-bit platforms, this risks sign extending values of size > 2GiB. Bug present since commit 489fd3 (v0.6.0). I'm not sure if a specially-crafted bogus qcow2 image could exploit this, although it's probably not possible, since we were already checking for the computed results being within range of our fixed-size buffer. * src/util/storage_file.c (qcowXGetBackingStore): Avoid sign extension. --- src/util/storage_file.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/util/storage_file.c b/src/util/storage_file.c index 6b3b756362..06cabc8b5a 100644 --- a/src/util/storage_file.c +++ b/src/util/storage_file.c @@ -274,7 +274,7 @@ qcowXGetBackingStore(char **res, bool isQCow2) { unsigned long long offset; - unsigned long size; + unsigned int size; *res = NULL; if (format) -- GitLab