diff options
| -rw-r--r-- | block/nbd-client.c | 10 | ||||
| -rw-r--r-- | migration/block-dirty-bitmap.c | 1 | ||||
| -rw-r--r-- | nbd/client.c | 18 |
3 files changed, 20 insertions, 9 deletions
diff --git a/block/nbd-client.c b/block/nbd-client.c index e7caf49fbb..8d69eaaa32 100644 --- a/block/nbd-client.c +++ b/block/nbd-client.c @@ -259,14 +259,18 @@ static int nbd_parse_blockstatus_payload(NBDClientSession *client, if (extent->length == 0 || (client->info.min_block && !QEMU_IS_ALIGNED(extent->length, - client->info.min_block)) || - extent->length > orig_length) - { + client->info.min_block))) { error_setg(errp, "Protocol error: server sent status chunk with " "invalid length"); return -EINVAL; } + /* The server is allowed to send us extra information on the final + * extent; just clamp it to the length we requested. */ + if (extent->length > orig_length) { + extent->length = orig_length; + } + return 0; } diff --git a/migration/block-dirty-bitmap.c b/migration/block-dirty-bitmap.c index dd04f102d8..8819aabe3a 100644 --- a/migration/block-dirty-bitmap.c +++ b/migration/block-dirty-bitmap.c @@ -600,6 +600,7 @@ static int dirty_bitmap_load_bits(QEMUFile *f, DirtyBitmapLoadState *s) ret = qemu_get_buffer(f, buf, buf_size); if (ret != buf_size) { error_report("Failed to read bitmap bits"); + g_free(buf); return -EIO; } diff --git a/nbd/client.c b/nbd/client.c index b9e175d1c2..232ff4f46d 100644 --- a/nbd/client.c +++ b/nbd/client.c @@ -435,8 +435,8 @@ static int nbd_opt_go(QIOChannel *ioc, const char *wantname, } be32_to_cpus(&info->min_block); if (!is_power_of_2(info->min_block)) { - error_setg(errp, "server minimum block size %" PRId32 - "is not a power of two", info->min_block); + error_setg(errp, "server minimum block size %" PRIu32 + " is not a power of two", info->min_block); nbd_send_opt_abort(ioc); return -1; } @@ -450,8 +450,8 @@ static int nbd_opt_go(QIOChannel *ioc, const char *wantname, be32_to_cpus(&info->opt_block); if (!is_power_of_2(info->opt_block) || info->opt_block < info->min_block) { - error_setg(errp, "server preferred block size %" PRId32 - "is not valid", info->opt_block); + error_setg(errp, "server preferred block size %" PRIu32 + " is not valid", info->opt_block); nbd_send_opt_abort(ioc); return -1; } @@ -462,6 +462,12 @@ static int nbd_opt_go(QIOChannel *ioc, const char *wantname, return -1; } be32_to_cpus(&info->max_block); + if (info->max_block < info->min_block) { + error_setg(errp, "server maximum block size %" PRIu32 + " is not valid", info->max_block); + nbd_send_opt_abort(ioc); + return -1; + } trace_nbd_opt_go_info_block_size(info->min_block, info->opt_block, info->max_block); break; @@ -613,8 +619,8 @@ static int nbd_negotiate_simple_meta_context(QIOChannel *ioc, { int ret; NBDOptionReply reply; - uint32_t received_id; - bool received; + uint32_t received_id = 0; + bool received = false; uint32_t export_len = strlen(export); uint32_t context_len = strlen(context); uint32_t data_len = sizeof(export_len) + export_len + |