A huge image size could cause s->l1_size to overflow. Make sure that images never require a L1 table larger than what fits in s->l1_size. This cannot only cause unbounded allocations, but also the allocation of a too small L1 table, resulting in out-of-bounds array accesses (both reads and writes). Cc: qemu-stable@nongnu.org Signed-off-by: Kevin Wolf <kwolf@redhat.com>
32 lines
1.4 KiB
Plaintext
32 lines
1.4 KiB
Plaintext
QA output created by 092
|
|
|
|
== Invalid cluster size ==
|
|
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864
|
|
qemu-io: can't open device TEST_DIR/t.qcow: Cluster size must be between 512 and 64k
|
|
no file open, try 'help open'
|
|
qemu-io: can't open device TEST_DIR/t.qcow: Cluster size must be between 512 and 64k
|
|
no file open, try 'help open'
|
|
qemu-io: can't open device TEST_DIR/t.qcow: Cluster size must be between 512 and 64k
|
|
no file open, try 'help open'
|
|
qemu-io: can't open device TEST_DIR/t.qcow: Cluster size must be between 512 and 64k
|
|
no file open, try 'help open'
|
|
|
|
== Invalid L2 table size ==
|
|
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864
|
|
qemu-io: can't open device TEST_DIR/t.qcow: L2 table size must be between 512 and 64k
|
|
no file open, try 'help open'
|
|
qemu-io: can't open device TEST_DIR/t.qcow: L2 table size must be between 512 and 64k
|
|
no file open, try 'help open'
|
|
qemu-io: can't open device TEST_DIR/t.qcow: L2 table size must be between 512 and 64k
|
|
no file open, try 'help open'
|
|
qemu-io: can't open device TEST_DIR/t.qcow: L2 table size must be between 512 and 64k
|
|
no file open, try 'help open'
|
|
|
|
== Invalid size ==
|
|
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864
|
|
qemu-io: can't open device TEST_DIR/t.qcow: Image too large
|
|
no file open, try 'help open'
|
|
qemu-io: can't open device TEST_DIR/t.qcow: Image too large
|
|
no file open, try 'help open'
|
|
*** done
|