On 14.05.2025 12:28, Michael Tokarev wrote:
On 13.05.2025 18:06, Kevin Wolf wrote:
Am 28.04.2025 um 15:58 hat Michael Tokarev geschrieben:
28.04.2025 16:54, Michael Tokarev пишет:
25.04.2025 20:52, Kevin Wolf wrote:
From: Denis Rastyogin <ger...@altlinux.org>
This error was discovered by fuzzing qemu-img.
Currently, running `qemu-img bench -d 0` in img_bench is allowed,
which is a pointless operation and causes qemu-img to hang.
Signed-off-by: Denis Rastyogin <ger...@altlinux.org>
Message-ID: <20250327162423.25154-5-ger...@altlinux.org>
Reviewed-by: Kevin Wolf <kw...@redhat.com>
Signed-off-by: Kevin Wolf <kw...@redhat.com>
---
qemu-img.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/qemu-img.c b/qemu-img.c
index 2044c22a4c..76ac5d3028 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -4571,7 +4571,7 @@ static int img_bench(int argc, char **argv)
{
unsigned long res;
- if (qemu_strtoul(optarg, NULL, 0, &res) < 0 || res >
INT_MAX) {
+ if (qemu_strtoul(optarg, NULL, 0, &res) <= 0 || res >
INT_MAX) {
error_report("Invalid queue depth specified");
return 1;
}
FWIW, it's been covered by my qemu-img options patches for way over
a year.
In particular:
https://lore.kernel.org/qemu-devel/20240927061121.573271-28-
m...@tls.msk.ru/
I'm still waiting for some feedback from these patches - heard
neither ACK
nor NACK for this rather large work.
Oops, seems I never continued review after patch 5. I'll get back to it.
However, I don't see the above hunk in that series. Am I missing it or
is there another series of yours waiting for review?
This one:
Actually it is the next very similar hunk. But doesn't matter anymore,
since this 4/4 partial patch has been applied already.
/mjt
@@ -4791,27 +4788,17 @@ static int img_bench(const img_cmd_t *ccmd, int
argc, char **argv)
);
break;
case 'c':
- {
- unsigned long res;
-
- if (qemu_strtoul(optarg, NULL, 0, &res) < 0 || res >
INT_MAX) {
- error_report("Invalid request count specified");
+ count = cvtnum_full("request count", optarg, false, 1,
INT_MAX);
+ if (count < 0) {
return 1;
}
