[Qemu-devel] [Bug 1355697] Re: qemu-img: Segfault on a fuzzed image with large values of L1/L2 entries

[Max Reitz]

Hi,

This issue has at least been partially fixed in master
(5f77ef69a195098baddfdc6d189f1b4a94587378):

$ ./qemu-img check -f qcow2 -r all copy.img
Warning: cluster offset=0xfffffffffe0000 is after the end of the image file, 
can't properly check refcounts.
Warning: cluster offset=0x100000000000000 is after the end of the image file, 
can't properly check refcounts.
ERROR l2_offset=fffffffffffe00: Table is not cluster aligned; L1 entry corrupted
Repairing cluster 0 refcount=0 reference=1
Repairing cluster 1 refcount=0 reference=1
qcow2: Marking image as corrupt: Preventing invalid write on metadata (overlaps 
with refcount table); further corruption events will be suppressed
Repairing cluster 21 refcount=0 reference=1

4 errors were found on the image.
Data may be corrupted, or further writes to the image may corrupt it.

2 internal errors have occurred during the check.
Image end offset: 2883584

I'm still working towards the repair function actually doing its job.

Thank you for your report,

Max

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1355697

Title:
  qemu-img: Segfault on a fuzzed image with large values of L1/L2
  entries

Status in QEMU:
  Fix Committed

Bug description:
  'qemu-img check -r all/leaks' failed with a segmentation fault on the
  fuzzed image with L1/L2 entry values having UINT64 border values.

  Sequence:
   1. Unpack the attached archive, make a copy of test.img
   2. Put copy.img and backing_img.raw in the same directory
   3. Execute
     
  qemu-img check -f qcow2 -r all copy.img

  Result: qemu-img was killed by SIGSEGV.

  The qemu-img execution log can be found in the attached archive.

  
  qemu.git HEAD 2d591ce2aeebf

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1355697/+subscriptions