From 21c941786ea0cb72114f3e9c7c940471664862b5 Mon Sep 17 00:00:00 2001 From: Dylan Reid Date: Sun, 9 Jun 2019 16:42:59 -0700 Subject: [PATCH] qcow: Calculate the max refcounts as a u64 u32's get multiplied together and can overflow. A usize was being returned, make everything a u64 to make sure it fits. Change-Id: I87071d294f4e62247c9ae72244db059a7b528b62 Signed-off-by: Dylan Reid Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1651459 Reviewed-by: Daniel Verkamp Reviewed-by: Zach Reizner Tested-by: kokoro --- qcow/src/qcow.rs | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/qcow/src/qcow.rs b/qcow/src/qcow.rs index 4c152d0d9c..eccd23d138 100644 --- a/qcow/src/qcow.rs +++ b/qcow/src/qcow.rs @@ -295,11 +295,12 @@ impl QcowHeader { } } -fn max_refcount_clusters(refcount_order: u32, cluster_size: u32, num_clusters: u32) -> usize { - let refcount_bytes = (0x01u32 << refcount_order) / 8; - let for_data = div_round_up_u32(num_clusters * refcount_bytes, cluster_size); - let for_refcounts = div_round_up_u32(for_data * refcount_bytes, cluster_size); - for_data as usize + for_refcounts as usize +fn max_refcount_clusters(refcount_order: u32, cluster_size: u32, num_clusters: u32) -> u64 { + // Use u64 as the product of the u32 inputs can overflow. + let refcount_bytes = (0x01 << refcount_order as u64) / 8; + let for_data = div_round_up_u64(num_clusters as u64 * refcount_bytes, cluster_size as u64); + let for_refcounts = div_round_up_u64(for_data * refcount_bytes, cluster_size as u64); + for_data + for_refcounts } /// Represents a qcow2 file. This is a sparse file format maintained by the qemu project. @@ -419,7 +420,7 @@ impl QcowFile { header.refcount_order, cluster_size as u32, (num_clusters + l1_clusters + num_l2_clusters + header_clusters) as u32, - ) as u64; + ); let refcount_block_entries = cluster_size / refcount_bytes; let refcounts = RefCount::new( &mut raw_file,