diff options
| author | Jeff Cody <jcody@redhat.com> | 2016-03-02 11:24:42 -0500 |
|---|---|---|
| committer | Jeff Cody <jcody@redhat.com> | 2016-03-16 13:25:29 -0400 |
| commit | 03c698f0a229c8f76cfc33f0d8f755047c41f5e6 (patch) | |
| tree | 672c07ee582656b398d065ccec2a7cfc35ef2199 /block/sheepdog.c | |
| parent | 0ebc03bc065329eaefb6493f5fa7df08df528f2a (diff) | |
| download | qemu-03c698f0a229c8f76cfc33f0d8f755047c41f5e6.tar.gz qemu-03c698f0a229c8f76cfc33f0d8f755047c41f5e6.tar.bz2 qemu-03c698f0a229c8f76cfc33f0d8f755047c41f5e6.zip | |
block/sheepdog: fix argument passed to qemu_strtoul()
The function qemu_strtoul() reads 'unsigned long' sized data,
which is larger than uint32_t on 64-bit machines.
Even though the snap_id field in the header is 32-bits, we must
accommodate the full size in qemu_strtoul().
This patch also adds more meaningful error handling to the
qemu_strtoul() call, and subsequent results.
Reported-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Jeff Cody <jcody@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Hitoshi Mitake <mitake.hitoshi@lab.ntt.co.jp>
Message-id: e56fc50abedd9a112e0683342c8eafda063cd2f9.1456935548.git.jcody@redhat.com
Diffstat (limited to 'block/sheepdog.c')
| -rw-r--r-- | block/sheepdog.c | 11 |
1 files changed, 7 insertions, 4 deletions
diff --git a/block/sheepdog.c b/block/sheepdog.c index a6e98a5a72..06ae3bac62 100644 --- a/block/sheepdog.c +++ b/block/sheepdog.c @@ -2549,7 +2549,7 @@ static int sd_snapshot_delete(BlockDriverState *bs, const char *name, Error **errp) { - uint32_t snap_id = 0; + unsigned long snap_id = 0; char snap_tag[SD_MAX_VDI_TAG_LEN]; Error *local_err = NULL; int fd, ret; @@ -2571,12 +2571,15 @@ static int sd_snapshot_delete(BlockDriverState *bs, memset(buf, 0, sizeof(buf)); memset(snap_tag, 0, sizeof(snap_tag)); pstrcpy(buf, SD_MAX_VDI_LEN, s->name); - if (qemu_strtoul(snapshot_id, NULL, 10, (unsigned long *)&snap_id)) { - return -1; + ret = qemu_strtoul(snapshot_id, NULL, 10, &snap_id); + if (ret || snap_id > UINT32_MAX) { + error_setg(errp, "Invalid snapshot ID: %s", + snapshot_id ? snapshot_id : "<null>"); + return -EINVAL; } if (snap_id) { - hdr.snapid = snap_id; + hdr.snapid = (uint32_t) snap_id; } else { pstrcpy(snap_tag, sizeof(snap_tag), snapshot_id); pstrcpy(buf + SD_MAX_VDI_LEN, SD_MAX_VDI_TAG_LEN, snap_tag); |