From: Kevin Wolf Date: Fri, 26 Oct 2012 14:33:32 +0000 (+0200) Subject: qcow2: Fix refcount table size calculation X-Git-Url: http://git.osdn.net/view?a=commitdiff_plain;h=a3548077062dd9dc2701ebffd931ba6eaef40bec;p=qmiga%2Fqemu.git qcow2: Fix refcount table size calculation A missing factor for the refcount table entry size in the calculation could mean that too little memory was allocated for the in-memory representation of the table, resulting in a buffer overflow. Signed-off-by: Kevin Wolf Reviewed-by: Michael Tokarev Tested-by: Michael Tokarev --- diff --git a/block/qcow2-refcount.c b/block/qcow2-refcount.c index 5e3f9153fb..96224d1af2 100644 --- a/block/qcow2-refcount.c +++ b/block/qcow2-refcount.c @@ -301,7 +301,8 @@ static int alloc_refcount_block(BlockDriverState *bs, uint64_t last_table_size; uint64_t blocks_clusters; do { - uint64_t table_clusters = size_to_clusters(s, table_size); + uint64_t table_clusters = + size_to_clusters(s, table_size * sizeof(uint64_t)); blocks_clusters = 1 + ((table_clusters + refcount_block_clusters - 1) / refcount_block_clusters);