qcow2: Catch !*host_offset for data allocation

qcow2_alloc_cluster_offset() uses host_offset == 0 as "no preferred
offset" for the (data) cluster range to be allocated. However, this
offset is actually valid and may be allocated on images with a corrupted
refcount table or first refcount block.

In this case, the corruption prevention should normally catch that
write anyway (because it would overwrite the image header). But since 0
is a special value here, the function assumes that nothing has been
allocated at all which it asserts against.

Because this condition is not qemu's fault but rather that of a broken
image, it shouldn't throw an assertion but rather mark the image corrupt
and show an appropriate message, which this patch does by calling the
corruption check earlier than it would be called normally (before the
assertion).

Signed-off-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
1 file changed
tree: b24f6ced7bcb579ee45bb907523f0efbbe4c565a
  1. audio/
  2. backends/
  3. block/
  4. bsd-user/
  5. default-configs/
  6. disas/
  7. docs/
  8. fpu/
  9. fsdev/
  10. gdb-xml/
  11. hw/
  12. include/
  13. libcacard/
  14. libdecnumber/
  15. linux-headers/
  16. linux-user/
  17. net/
  18. pc-bios/
  19. po/
  20. qapi/
  21. qga/
  22. qobject/
  23. qom/
  24. roms/
  25. scripts/
  26. slirp/
  27. stubs/
  28. sysconfigs/
  29. target-alpha/
  30. target-arm/
  31. target-cris/
  32. target-i386/
  33. target-lm32/
  34. target-m68k/
  35. target-microblaze/
  36. target-mips/
  37. target-moxie/
  38. target-openrisc/
  39. target-ppc/
  40. target-s390x/
  41. target-sh4/
  42. target-sparc/
  43. target-unicore32/
  44. target-xtensa/
  45. tcg/
  46. tests/
  47. trace/
  48. ui/
  49. util/
  50. .exrc
  51. .gitignore
  52. .gitmodules
  53. .mailmap
  54. .travis.yml
  55. aio-posix.c
  56. aio-win32.c
  57. arch_init.c
  58. async.c
  59. balloon.c
  60. block-migration.c
  61. block.c
  62. blockdev-nbd.c
  63. blockdev.c
  64. blockjob.c
  65. bt-host.c
  66. bt-vhci.c
  67. Changelog
  68. CODING_STYLE
  69. configure
  70. COPYING
  71. COPYING.LIB
  72. coroutine-gthread.c
  73. coroutine-sigaltstack.c
  74. coroutine-ucontext.c
  75. coroutine-win32.c
  76. cpu-exec.c
  77. cpus.c
  78. cputlb.c
  79. device-hotplug.c
  80. device_tree.c
  81. disas.c
  82. dma-helpers.c
  83. dump.c
  84. exec.c
  85. gdbstub.c
  86. HACKING
  87. hmp-commands.hx
  88. hmp.c
  89. hmp.h
  90. iohandler.c
  91. ioport.c
  92. iothread.c
  93. kvm-all.c
  94. kvm-stub.c
  95. LICENSE
  96. main-loop.c
  97. MAINTAINERS
  98. Makefile
  99. Makefile.objs
  100. Makefile.target
  101. memory.c
  102. memory_mapping.c
  103. migration-exec.c
  104. migration-fd.c
  105. migration-rdma.c
  106. migration-tcp.c
  107. migration-unix.c
  108. migration.c
  109. module-common.c
  110. monitor.c
  111. nbd.c
  112. numa.c
  113. os-posix.c
  114. os-win32.c
  115. page_cache.c
  116. qapi-schema.json
  117. qdev-monitor.c
  118. qdict-test-data.txt
  119. qemu-bridge-helper.c
  120. qemu-char.c
  121. qemu-coroutine-io.c
  122. qemu-coroutine-lock.c
  123. qemu-coroutine-sleep.c
  124. qemu-coroutine.c
  125. qemu-doc.texi
  126. qemu-file.c
  127. qemu-img-cmds.hx
  128. qemu-img.c
  129. qemu-img.texi
  130. qemu-io-cmds.c
  131. qemu-io.c
  132. qemu-log.c
  133. qemu-nbd.c
  134. qemu-nbd.texi
  135. qemu-options-wrapper.h
  136. qemu-options.h
  137. qemu-options.hx
  138. qemu-seccomp.c
  139. qemu-tech.texi
  140. qemu-timer.c
  141. qemu.nsi
  142. qemu.sasl
  143. qmp-commands.hx
  144. qmp.c
  145. qtest.c
  146. README
  147. rules.mak
  148. savevm.c
  149. softmmu_template.h
  150. spice-qemu-char.c
  151. tcg-runtime.c
  152. tci.c
  153. thread-pool.c
  154. thunk.c
  155. tpm.c
  156. trace-events
  157. translate-all.c
  158. translate-all.h
  159. user-exec.c
  160. VERSION
  161. version.rc
  162. vl.c
  163. vmstate.c
  164. xbzrle.c
  165. xen-common-stub.c
  166. xen-common.c
  167. xen-hvm-stub.c
  168. xen-hvm.c
  169. xen-mapcache.c