mirror of
https://gitlab.com/qemu-project/qemu.git
synced 2026-10-28 14:04:39 +08:00
Denis V. Lunev
22065d20ed
The chunk size is an int and is shifted left by 3 before the result is widened, so a chunk size of 1 << 28 or above overflows. parallels passes s->cluster_size, which parallels_open() lets reach 2 GiB. With a bitmap needing two L1 entries the bogus limit makes the "bm_size - offset" in parallels_load_bitmap_data() underflow; both wrong values slip past the assertions in serialization_chunk() and the resulting index lands outside the hbitmap, so a 128 KiB image memsets unrelated memory through hbitmap_deserialize_ones(). Widen the shift. qcow2, the only other caller, never exceeds a 2 MiB cluster. Fixes:35f428ba39("qcow2-bitmap: make bytes_covered_by_bitmap_cluster() public") Cc: Eric Blake <eblake@redhat.com> Cc: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru> Cc: Stefan Hajnoczi <stefanha@redhat.com> Cc: Thomas Huth <thuth@redhat.com> Signed-off-by: Denis V. Lunev <den@openvz.org> Message-ID: <20260811173857.396571-4-den@openvz.org> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru> Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru> (cherry picked from commitdc04053687) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>