Google Git
Sign in
qemu / qemu / 951053a9ec1c47edf4b2549ef58d82aee8a42a7f
commit951053a9ec1c47edf4b2549ef58d82aee8a42a7f[log] [tgz]
authorAlberto Garcia <berto@igalia.com>Fri Nov 03 16:18:53 2017 +0200
committerMax Reitz <mreitz@redhat.com>Tue Nov 14 18:06:25 2017 +0100
tree7ad3b60159e618506325a63dd64efd0dc083f4d5
parent8aa34834d566ba4e635d6029339a5f4f1ae1685e [diff]
qcow2: Don't open images with header.refcount_table_clusters == 0

qcow2_do_open() is checking that header.refcount_table_clusters is not
too large, but it doesn't check that it's greater than zero. Apart
from the fact that an image like that is obviously corrupted, trying
to use it crashes QEMU since we end up with a null s->refcount_table
after qcow2_refcount_init().

These images can however be repaired, so allow opening them if the
BDRV_O_CHECK flag is set.

Signed-off-by: Alberto Garcia <berto@igalia.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Message-id: f9750f50c80359babba11062e88f5075a47e8e16.1509718618.git.berto@igalia.com
Signed-off-by: Max Reitz <mreitz@redhat.com>
3 files changed
tree: 7ad3b60159e618506325a63dd64efd0dc083f4d5
  1. accel/
  2. audio/
  3. backends/
  4. block/
  5. bsd-user/
  6. chardev/
  7. contrib/
  8. crypto/
  9. default-configs/
  10. disas/
  11. docs/
  12. fpu/
  13. fsdev/
  14. gdb-xml/
  15. hw/
  16. include/
  17. io/
  18. libdecnumber/
  19. linux-headers/
  20. linux-user/
  21. migration/
  22. nbd/
  23. net/
  24. pc-bios/
  25. po/
  26. qapi/
  27. qga/
  28. qobject/
  29. qom/
  30. replay/
  31. roms/
  32. scripts/
  33. scsi/
  34. slirp/
  35. stubs/
  36. target/
  37. tcg/
  38. tests/
  39. trace/
  40. ui/
  41. util/
  42. capstone
  43. dtc
  44. .dir-locals.el
  45. .editorconfig
  46. .exrc
  47. .gdbinit
  48. .gitignore
  49. .gitmodules
  50. .mailmap
  51. .shippable.yml
  52. .travis.yml
  53. arch_init.c
  54. balloon.c
  55. block.c
  56. blockdev-nbd.c
  57. blockdev.c
  58. blockjob.c
  59. bootdevice.c
  60. bt-host.c
  61. bt-vhci.c
  62. Changelog
  63. CODING_STYLE
  64. configure
  65. COPYING
  66. COPYING.LIB
  67. COPYING.PYTHON
  68. cpus-common.c
  69. cpus.c
  70. device-hotplug.c
  71. device_tree.c
  72. disas.c
  73. dma-helpers.c
  74. dump.c
  75. exec.c
  76. gdbstub.c
  77. HACKING
  78. hmp-commands-info.hx
  79. hmp-commands.hx
  80. hmp.c
  81. hmp.h
  82. ioport.c
  83. iothread.c
  84. LICENSE
  85. MAINTAINERS
  86. Makefile
  87. Makefile.objs
  88. Makefile.target
  89. memory.c
  90. memory_ldst.inc.c
  91. memory_mapping.c
  92. module-common.c
  93. monitor.c
  94. numa.c
  95. os-posix.c
  96. os-win32.c
  97. qapi-schema.json
  98. qdev-monitor.c
  99. qdict-test-data.txt
  100. qemu-bridge-helper.c
  101. qemu-doc.texi
  102. qemu-ga.texi
  103. qemu-img-cmds.hx
  104. qemu-img.c
  105. qemu-img.texi
  106. qemu-io-cmds.c
  107. qemu-io.c
  108. qemu-keymap.c
  109. qemu-nbd.c
  110. qemu-nbd.texi
  111. qemu-option-trace.texi
  112. qemu-options-wrapper.h
  113. qemu-options.h
  114. qemu-options.hx
  115. qemu-seccomp.c
  116. qemu-tech.texi
  117. qemu.nsi
  118. qemu.sasl
  119. qmp.c
  120. qtest.c
  121. README
  122. replication.c
  123. replication.h
  124. rules.mak
  125. thunk.c
  126. tpm.c
  127. trace-events
  128. VERSION
  129. version.rc
  130. vl.c