Skip to content

Commit 6b36a57

Browse files
Gerben100kevmw
authored andcommitted
qemu-img: fix division by zero in bench_cb() for zero-sized images
This error was discovered by fuzzing qemu-img. This commit fixes a division by zero error in the bench_cb() function that occurs when using the bench command with a zero-sized image. The issue arises because b->image_size can be zero, leading to a division by zero in the modulo operation (b->offset %= b->image_size). This patch adds a check for b->image_size == 0 and resets b->offset to 0 in such cases, preventing the error. Signed-off-by: Denis Rastyogin <[email protected]> Message-ID: <[email protected]> Reviewed-by: Kevin Wolf <[email protected]> Signed-off-by: Kevin Wolf <[email protected]>
1 parent dfaecc0 commit 6b36a57

File tree

1 file changed

+5
-1
lines changed

1 file changed

+5
-1
lines changed

qemu-img.c

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4488,7 +4488,11 @@ static void bench_cb(void *opaque, int ret)
44884488
*/
44894489
b->in_flight++;
44904490
b->offset += b->step;
4491-
b->offset %= b->image_size;
4491+
if (b->image_size == 0) {
4492+
b->offset = 0;
4493+
} else {
4494+
b->offset %= b->image_size;
4495+
}
44924496
if (b->write) {
44934497
acb = blk_aio_pwritev(b->blk, offset, b->qiov, 0, bench_cb, b);
44944498
} else {

0 commit comments

Comments
 (0)