blob: 71ca2c4c77de63715b4d0fa9f90d0d7e30ed2f67 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
|
graphic: 0.764
semantic: 0.737
performance: 0.721
device: 0.656
files: 0.643
mistranslation: 0.596
ppc: 0.516
PID: 0.489
network: 0.475
vnc: 0.469
x86: 0.457
socket: 0.455
kernel: 0.420
architecture: 0.396
i386: 0.393
risc-v: 0.383
arm: 0.364
user-level: 0.334
TCG: 0.316
permissions: 0.302
register: 0.287
peripherals: 0.280
hypervisor: 0.280
boot: 0.275
virtual: 0.258
debug: 0.257
VMM: 0.233
KVM: 0.228
assembly: 0.196
qemu-io: Failure on a qcow2 image with the fuzzed refcount table
'qemu-io -c write' and 'qemu-io -c aio_write' crashes on a qcow2 image with a fuzzed refcount table.
Sequence:
1. Unpack the attached archive, make a copy of test.img
2. Put copy.img and backing_img.file in the same directory
3. Execute
qemu-io copy.img -c write 279552 322560
or
qemu-io copy.img -c aio_write 836608 166400
Result: qemu-io was killed by SIGIOT with the reason:
qemu-io: block/qcow2-cluster.c:1291: qcow2_alloc_cluster_offset: Assertion `*host_offset != 0' failed.
qemu.git HEAD 69f87f713069f1f
Hi,
this has been fixed in upstream master (5f77ef69a195098baddfdc6d189f1b4a94587378):
$ ./qemu-io copy.img -c 'aio_write 836608 166400'
qcow2: Marking image as corrupt: Preventing invalid write on metadata (overlaps with qcow2_header); further corruption events will be suppressed
aio_write failed: Input/output error
Thanks for your report,
Max
|