graphic: 0.764
semantic: 0.737
performance: 0.721
device: 0.656
files: 0.643
PID: 0.489
network: 0.475
vnc: 0.469
socket: 0.455
permissions: 0.302
boot: 0.275
debug: 0.257
KVM: 0.228
other: 0.118

qemu-io: Failure on a qcow2 image with the fuzzed refcount table

'qemu-io -c write' and 'qemu-io -c aio_write' crashes on a qcow2 image with a fuzzed refcount table.

Sequence:
 1. Unpack the attached archive, make a copy of test.img
 2. Put copy.img and backing_img.file in the same directory
 3. Execute
    qemu-io copy.img -c write 279552 322560
                      or
   qemu-io copy.img -c aio_write 836608 166400

Result: qemu-io was killed by SIGIOT with the reason:

qemu-io: block/qcow2-cluster.c:1291: qcow2_alloc_cluster_offset: Assertion `*host_offset != 0' failed.

qemu.git HEAD 69f87f713069f1f



Hi,

this has been fixed in upstream master (5f77ef69a195098baddfdc6d189f1b4a94587378):

$ ./qemu-io copy.img -c 'aio_write 836608 166400'
qcow2: Marking image as corrupt: Preventing invalid write on metadata (overlaps with qcow2_header); further corruption events will be suppressed
aio_write failed: Input/output error

Thanks for your report,

Max