blob: 72b24bf6886509f8a1918f5fe591c42acf0a2cf6 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
|
device: 0.595
PID: 0.565
files: 0.563
semantic: 0.495
network: 0.490
architecture: 0.459
graphic: 0.452
performance: 0.446
socket: 0.444
ppc: 0.435
risc-v: 0.416
vnc: 0.413
arm: 0.409
hypervisor: 0.402
kernel: 0.400
permissions: 0.381
i386: 0.351
peripherals: 0.337
x86: 0.328
boot: 0.323
VMM: 0.314
register: 0.309
TCG: 0.306
KVM: 0.256
virtual: 0.249
assembly: 0.217
mistranslation: 0.214
debug: 0.186
user-level: 0.164
qemu-img: Assert for 'amend' command and the fuzzed image
'qemu-img amend' failed with the assert on the fuzzed image.
Sequence:
1. Unpack the attached archive, make a copy of test.img
2. Put copy.img and backing_img.vdi in the same directory
3. Execute
qemu-img amend -o compat=0.10 -f qcow2 copy.img
Result: qemu-img was killed by SIGIOT with the reason:
qemu-img: block/qcow2-cluster.c:1598: expand_zero_clusters_in_l1: Assertion `(cluster_index >= 0) && (cluster_index < *nb_clusters)' failed.
qemu.git HEAD 2d591ce2aeebf
Hi,
This issue should be fixed by my "[PATCH v3 0/7] block/qcow2: Improve zero cluster expansion" series.
However, there are similar issues in qemu, so we'll probably need a function to quickly mark an image corrupt instead of throwing these assertions.
Max
Hi,
This issue has been fixed in master (af3ff19b48f0bbf3a8bd35c47460358e8c6ae5e5, 2.2.0-rc2):
$ ./qemu-img amend -o compat=0.10 -f qcow2 copy.img
qemu-img: Error while amending options: File too large
Thanks for your report,
Max
|