From b62e82be06a97ce48d1363bb28e8215ab2487a20 Mon Sep 17 00:00:00 2001 From: Dmitry Frolov Date: Wed, 6 Nov 2024 11:04:36 +0300 Subject: [PATCH] parallels: fix possible int overflow The sum "cluster_index + count" may overflow uint32_t. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Dmitry Frolov Message-ID: <20241106080521.219255-2-frolov@swemel.ru> Reviewed-by: Kevin Wolf Signed-off-by: Kevin Wolf --- block/parallels.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/block/parallels.c b/block/parallels.c index 9205a0864f..071b6dcaf8 100644 --- a/block/parallels.c +++ b/block/parallels.c @@ -184,11 +184,11 @@ static int mark_used(BlockDriverState *bs, unsigned long *bitmap, BDRVParallelsState *s = bs->opaque; uint32_t cluster_index = host_cluster_index(s, off); unsigned long next_used; - if (cluster_index + count > bitmap_size) { + if ((uint64_t)cluster_index + count > bitmap_size) { return -E2BIG; } next_used = find_next_bit(bitmap, bitmap_size, cluster_index); - if (next_used < cluster_index + count) { + if (next_used < (uint64_t)cluster_index + count) { return -EBUSY; } bitmap_set(bitmap, cluster_index, count); -- 2.30.2