From patchwork Fri Mar 31 13:13:00 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Peter Maydell X-Patchwork-Id: 96423 Delivered-To: patches@linaro.org Received: by 10.140.89.233 with SMTP id v96csp723088qgd; Fri, 31 Mar 2017 06:13:02 -0700 (PDT) X-Received: by 10.223.173.53 with SMTP id p50mr3139008wrc.116.1490965982453; Fri, 31 Mar 2017 06:13:02 -0700 (PDT) Return-Path: Received: from orth.archaic.org.uk (orth.archaic.org.uk. [2001:8b0:1d0::2]) by mx.google.com with ESMTPS id c185si3389181wmf.168.2017.03.31.06.13.02 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 31 Mar 2017 06:13:02 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of pm215@archaic.org.uk designates 2001:8b0:1d0::2 as permitted sender) client-ip=2001:8b0:1d0::2; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of pm215@archaic.org.uk designates 2001:8b0:1d0::2 as permitted sender) smtp.mailfrom=pm215@archaic.org.uk; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from pm215 by orth.archaic.org.uk with local (Exim 4.84_2) (envelope-from ) id 1ctwMO-00048u-Gr; Fri, 31 Mar 2017 14:13:00 +0100 From: Peter Maydell To: qemu-devel@nongnu.org Cc: patches@linaro.org, Stefan Hajnoczi , "Denis V. Lunev" , Kevin Wolf , Max Reitz , qemu-block@nongnu.org Subject: [PATCH] block/parallels.c: avoid integer overflow in allocate_clusters() Date: Fri, 31 Mar 2017 14:13:00 +0100 Message-Id: <1490965980-513-1-git-send-email-peter.maydell@linaro.org> X-Mailer: git-send-email 2.7.4 Coverity (CID 1307776) points out that in the multiply: space = to_allocate * s->tracks; we are trying to calculate a 64 bit result but the types of to_allocate and s->tracks mean that we actually calculate a 32 bit result. Add an explicit cast to force a 64 bit multiply. Signed-off-by: Peter Maydell --- NB: compile-and-make-check tested only... --- block/parallels.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.7.4 Reviewed-by: Philippe Mathieu-Daudé diff --git a/block/parallels.c b/block/parallels.c index 4173b3f..3886c30 100644 --- a/block/parallels.c +++ b/block/parallels.c @@ -206,7 +206,7 @@ static int64_t allocate_clusters(BlockDriverState *bs, int64_t sector_num, } to_allocate = DIV_ROUND_UP(sector_num + *pnum, s->tracks) - idx; - space = to_allocate * s->tracks; + space = (int64_t)to_allocate * s->tracks; if (s->data_end + space > bdrv_getlength(bs->file->bs) >> BDRV_SECTOR_BITS) { int ret; space += s->prealloc_size;