2ebafc854d
After reading the extension header, offset is incremented, but not checked against end_offset any more. This way an integer overflow could happen when checking whether the extension end is within the allowed range, effectively disabling the check. This patch adds the missing check and a test case for it. Cc: qemu-stable@nongnu.org Reported-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Message-id: 1416935562-7760-2-git-send-email-kwolf@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
86 lines
3.5 KiB
Plaintext
86 lines
3.5 KiB
Plaintext
QA output created by 080
|
|
|
|
== Huge header size ==
|
|
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864
|
|
qemu-io: can't open device TEST_DIR/t.qcow2: qcow2 header exceeds cluster size
|
|
no file open, try 'help open'
|
|
qemu-io: can't open device TEST_DIR/t.qcow2: qcow2 header exceeds cluster size
|
|
no file open, try 'help open'
|
|
|
|
== Huge unknown header extension ==
|
|
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864
|
|
qemu-io: can't open device TEST_DIR/t.qcow2: Invalid backing file offset
|
|
no file open, try 'help open'
|
|
qemu-io: can't open device TEST_DIR/t.qcow2: Header extension too large
|
|
no file open, try 'help open'
|
|
qemu-io: can't open device TEST_DIR/t.qcow2: Header extension too large
|
|
no file open, try 'help open'
|
|
|
|
== Huge refcount table size ==
|
|
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864
|
|
qemu-io: can't open device TEST_DIR/t.qcow2: Reference count table too large
|
|
no file open, try 'help open'
|
|
qemu-io: can't open device TEST_DIR/t.qcow2: Reference count table too large
|
|
no file open, try 'help open'
|
|
|
|
== Misaligned refcount table ==
|
|
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864
|
|
qemu-io: can't open device TEST_DIR/t.qcow2: Invalid reference count table offset
|
|
no file open, try 'help open'
|
|
|
|
== Huge refcount offset ==
|
|
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864
|
|
qemu-io: can't open device TEST_DIR/t.qcow2: Invalid reference count table offset
|
|
no file open, try 'help open'
|
|
|
|
== Invalid snapshot table ==
|
|
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864
|
|
qemu-io: can't open device TEST_DIR/t.qcow2: Too many snapshots
|
|
no file open, try 'help open'
|
|
qemu-io: can't open device TEST_DIR/t.qcow2: Too many snapshots
|
|
no file open, try 'help open'
|
|
qemu-io: can't open device TEST_DIR/t.qcow2: Invalid snapshot table offset
|
|
no file open, try 'help open'
|
|
qemu-io: can't open device TEST_DIR/t.qcow2: Invalid snapshot table offset
|
|
no file open, try 'help open'
|
|
|
|
== Hitting snapshot table size limit ==
|
|
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864
|
|
qemu-img: Could not create snapshot 'test': -27 (File too large)
|
|
read 512/512 bytes at offset 0
|
|
512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
|
|
|
|
== Invalid L1 table ==
|
|
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864
|
|
qemu-io: can't open device TEST_DIR/t.qcow2: Active L1 table too large
|
|
no file open, try 'help open'
|
|
qemu-io: can't open device TEST_DIR/t.qcow2: Active L1 table too large
|
|
no file open, try 'help open'
|
|
qemu-io: can't open device TEST_DIR/t.qcow2: Invalid L1 table offset
|
|
no file open, try 'help open'
|
|
qemu-io: can't open device TEST_DIR/t.qcow2: Invalid L1 table offset
|
|
no file open, try 'help open'
|
|
|
|
== Invalid L1 table (with internal snapshot in the image) ==
|
|
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864
|
|
qemu-img: Could not open 'TEST_DIR/t.IMGFMT': L1 table is too small
|
|
|
|
== Invalid backing file size ==
|
|
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864
|
|
qemu-io: can't open device TEST_DIR/t.qcow2: Backing file name too long
|
|
no file open, try 'help open'
|
|
|
|
== Invalid L2 entry (huge physical offset) ==
|
|
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864
|
|
wrote 512/512 bytes at offset 0
|
|
512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
|
|
qemu-img: Could not create snapshot 'test': -27 (File too large)
|
|
qemu-img: Could not create snapshot 'test': -11 (Resource temporarily unavailable)
|
|
|
|
== Invalid snapshot L1 table ==
|
|
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864
|
|
wrote 512/512 bytes at offset 0
|
|
512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
|
|
qemu-img: Failed to load snapshot: Snapshot L1 table too large
|
|
*** done
|