block: prevent multiwrite_merge from creating too large iovecs

[qemu.git] / block.c

diff --git a/block.c b/block.c
index 73c26ec410429fe5282dd66505246752bb015ea5..cde41295bd438007f79160bbc4d353b9f2398e3a 100644 (file)
--- a/block.c
+++ b/block.c
@@ -1689,6 +1689,10 @@ static int multiwrite_merge(BlockDriverState *bs, BlockRequest *reqs,
             merge = bs->drv->bdrv_merge_requests(bs, &reqs[outidx], &reqs[i]);
         }
 
+        if (reqs[outidx].qiov->niov + reqs[i].qiov->niov + 1 > IOV_MAX) {
+            merge = 0;
+        }
+
         if (merge) {
             size_t size;
             QEMUIOVector *qiov = qemu_mallocz(sizeof(*qiov));