Google Git
Sign in
qemu / qemu / a3548077062dd9dc2701ebffd931ba6eaef40bec
commita3548077062dd9dc2701ebffd931ba6eaef40bec[log] [tgz]
authorKevin Wolf <kwolf@redhat.com>Fri Oct 26 16:33:32 2012 +0200
committerKevin Wolf <kwolf@redhat.com>Wed Nov 14 18:19:21 2012 +0100
tree910fe8f72cc51590b303e8cdebb73ddaf00a9c6a
parent8809e28937b8a48ff0dfeeb93498641392f26019 [diff]
qcow2: Fix refcount table size calculation

A missing factor for the refcount table entry size in the calculation
could mean that too little memory was allocated for the in-memory
representation of the table, resulting in a buffer overflow.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Tested-by: Michael Tokarev <mjt@tls.msk.ru>
1 file changed
tree: 910fe8f72cc51590b303e8cdebb73ddaf00a9c6a
  1. audio/
  2. block/
  3. bsd-user/
  4. default-configs/
  5. docs/
  6. fpu/
  7. fsdev/
  8. gdb-xml/
  9. hw/
  10. include/
  11. libcacard/
  12. linux-headers/
  13. linux-user/
  14. net/
  15. pc-bios/
  16. qapi/
  17. qga/
  18. QMP/
  19. qom/
  20. roms/
  21. scripts/
  22. slirp/
  23. sysconfigs/
  24. target-alpha/
  25. target-arm/
  26. target-cris/
  27. target-i386/
  28. target-lm32/
  29. target-m68k/
  30. target-microblaze/
  31. target-mips/
  32. target-openrisc/
  33. target-ppc/
  34. target-s390x/
  35. target-sh4/
  36. target-sparc/
  37. target-unicore32/
  38. target-xtensa/
  39. tcg/
  40. tests/
  41. trace/
  42. ui/
  43. pixman
  44. .exrc
  45. .gitignore
  46. .gitmodules
  47. .mailmap
  48. a.out.h
  49. acl.c
  50. acl.h
  51. aes.c
  52. aes.h
  53. aio-posix.c
  54. aio-win32.c
  55. alpha-dis.c
  56. alpha.ld
  57. arch_init.c
  58. arch_init.h
  59. arm-dis.c
  60. arm.ld
  61. async.c
  62. balloon.c
  63. balloon.h
  64. bitmap.c
  65. bitmap.h
  66. bitops.c
  67. bitops.h
  68. block-migration.c
  69. block-migration.h
  70. block.c
  71. block.h
  72. block_int.h
  73. blockdev-nbd.c
  74. blockdev.c
  75. blockdev.h
  76. blockjob.c
  77. blockjob.h
  78. bswap.h
  79. bt-host.c
  80. bt-host.h
  81. bt-vhci.c
  82. buffered_file.c
  83. buffered_file.h
  84. cache-utils.c
  85. cache-utils.h
  86. Changelog
  87. cmd.c
  88. cmd.h
  89. CODING_STYLE
  90. compatfd.c
  91. compatfd.h
  92. compiler.h
  93. config.h
  94. configure
  95. console.c
  96. console.h
  97. COPYING
  98. COPYING.LIB
  99. coroutine-gthread.c
  100. coroutine-sigaltstack.c
  101. coroutine-ucontext.c
  102. coroutine-win32.c
  103. cpu-all.h
  104. cpu-common.h
  105. cpu-defs.h
  106. cpu-exec.c
  107. cpus.c
  108. cpus.h
  109. cputlb.c
  110. cputlb.h
  111. cris-dis.c
  112. cursor.c
  113. cursor_hidden.xpm
  114. cursor_left_ptr.xpm
  115. cutils.c
  116. def-helper.h
  117. device_tree.c
  118. device_tree.h
  119. dis-asm.h
  120. disas.c
  121. disas.h
  122. dma-helpers.c
  123. dma.h
  124. dump-stub.c
  125. dump.c
  126. dump.h
  127. elf.h
  128. envlist.c
  129. envlist.h
  130. error.c
  131. error.h
  132. event_notifier-posix.c
  133. event_notifier-win32.c
  134. event_notifier.h
  135. exec-all.h
  136. exec-memory.h
  137. exec.c
  138. gdbstub.c
  139. gdbstub.h
  140. gen-icount.h
  141. HACKING
  142. hmp-commands.hx
  143. hmp.c
  144. hmp.h
  145. host-utils.c
  146. host-utils.h
  147. hppa-dis.c
  148. hppa.ld
  149. hwaddr.h
  150. i386-dis.c
  151. i386.ld
  152. ia64-dis.c
  153. ia64.ld
  154. input.c
  155. int128.h
  156. iohandler.c
  157. ioport.c
  158. ioport.h
  159. iorange.h
  160. iov.c
  161. iov.h
  162. json-lexer.c
  163. json-lexer.h
  164. json-parser.c
  165. json-parser.h
  166. json-streamer.c
  167. json-streamer.h
  168. kvm-all.c
  169. kvm-stub.c
  170. kvm.h
  171. libfdt_env.h
  172. LICENSE
  173. lm32-dis.c
  174. m68k-dis.c
  175. m68k.ld
  176. main-loop.c
  177. main-loop.h
  178. MAINTAINERS
  179. Makefile
  180. Makefile.dis
  181. Makefile.objs
  182. Makefile.target
  183. Makefile.user
  184. memory-internal.h
  185. memory.c
  186. memory.h
  187. memory_mapping-stub.c
  188. memory_mapping.c
  189. memory_mapping.h
  190. microblaze-dis.c
  191. migration-exec.c
  192. migration-fd.c
  193. migration-tcp.c
  194. migration-unix.c
  195. migration.c
  196. migration.h
  197. mips-dis.c
  198. mips.ld
  199. module.c
  200. module.h
  201. monitor.c
  202. monitor.h
  203. nbd.c
  204. nbd.h
  205. net.c
  206. net.h
  207. notify.c
  208. notify.h
  209. os-posix.c
  210. os-win32.c
  211. osdep.c
  212. osdep.h
  213. oslib-posix.c
  214. oslib-win32.c
  215. page_cache.c
  216. path.c
  217. pci-ids.txt
  218. poison.h
  219. ppc-dis.c
  220. ppc.ld
  221. ppc64.ld
  222. qapi-schema-guest.json
  223. qapi-schema-test.json
  224. qapi-schema.json
  225. qbool.c
  226. qbool.h
  227. qdict-test-data.txt
  228. qdict.c
  229. qdict.h
  230. qemu-aio.h
  231. qemu-barrier.h
  232. qemu-bridge-helper.c
  233. qemu-char.c
  234. qemu-char.h
  235. qemu-common.h
  236. qemu-config.c
  237. qemu-config.h
  238. qemu-coroutine-int.h
  239. qemu-coroutine-io.c
  240. qemu-coroutine-lock.c
  241. qemu-coroutine-sleep.c
  242. qemu-coroutine.c
  243. qemu-coroutine.h
  244. qemu-doc.texi
  245. qemu-error.c
  246. qemu-error.h
  247. qemu-file.h
  248. qemu-ga.c
  249. qemu-img-cmds.hx
  250. qemu-img.c
  251. qemu-img.texi
  252. qemu-io.c
  253. qemu-lock.h
  254. qemu-log.c
  255. qemu-log.h
  256. qemu-nbd.c
  257. qemu-nbd.texi
  258. qemu-objects.h
  259. qemu-option-internal.h
  260. qemu-option.c
  261. qemu-option.h
  262. qemu-options-wrapper.h
  263. qemu-options.h
  264. qemu-options.hx
  265. qemu-os-posix.h
  266. qemu-os-win32.h
  267. qemu-pixman.c
  268. qemu-pixman.h
  269. qemu-progress.c
  270. qemu-queue.h
  271. qemu-seccomp.c
  272. qemu-seccomp.h
  273. qemu-sockets.c
  274. qemu-tech.texi
  275. qemu-thread-posix.c
  276. qemu-thread-posix.h
  277. qemu-thread-win32.c
  278. qemu-thread-win32.h
  279. qemu-thread.h
  280. qemu-timer-common.c
  281. qemu-timer.c
  282. qemu-timer.h
  283. qemu-tls.h
  284. qemu-tool.c
  285. qemu-user.c
  286. qemu-x509.h
  287. qemu-xattr.h
  288. qemu.sasl
  289. qemu_socket.h
  290. qerror.c
  291. qerror.h
  292. qfloat.c
  293. qfloat.h
  294. qint.c
  295. qint.h
  296. qjson.c
  297. qjson.h
  298. qlist.c
  299. qlist.h
  300. qmp-commands.hx
  301. qmp.c
  302. qobject.h
  303. qstring.c
  304. qstring.h
  305. qtest.c
  306. qtest.h
  307. range.h
  308. readline.c
  309. readline.h
  310. README
  311. rules.mak
  312. s390-dis.c
  313. s390.ld
  314. savevm.c
  315. sh4-dis.c
  316. softmmu-semi.h
  317. softmmu_defs.h
  318. softmmu_exec.h
  319. softmmu_header.h
  320. softmmu_template.h
  321. sparc-dis.c
  322. sparc.ld
  323. sparc64.ld
  324. spice-qemu-char.c
  325. sysemu.h
  326. tcg-runtime.c
  327. tci-dis.c
  328. tci.c
  329. thread-pool.c
  330. thread-pool.h
  331. thunk.c
  332. thunk.h
  333. TODO
  334. trace-events
  335. translate-all.c
  336. uboot_image.h
  337. uri.c
  338. uri.h
  339. user-exec.c
  340. VERSION
  341. version.rc
  342. vgafont.h
  343. vl.c
  344. vmstate.h
  345. x86_64.ld
  346. xen-all.c
  347. xen-mapcache.c
  348. xen-mapcache.h
  349. xen-stub.c