-
由 aliguori 提交于
The bdrv layer uses a signed offset. Furthermore, block-raw-posix only seeks when that offset is positive. Passing a negative offset to block-raw-posix can result in data being written at the current seek cursor's position. It may be possible to exploit this to seek to the end of the disk and extend the virtual disk by writing data to a negative sector offset. After a reboot, this could lead to the guest having a larger disk than it had before. Close the hole by sanity checking the lba against the size of the disk. Signed-off-by: NRik van Riel <riel@redhat.com> Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com> git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@6475 c046a42c-6fe2-441c-8c8c-71466251a162
274fb0e1