block/raw-posix: Abort on pread beyond end of non-growable file

This shouldn't happen under any normal circumstances. However, it looks like
it's possible to achieve this with corrupted images. Without this patch
raw_pread is hanging in an endless loop in such cases.

The patch is not affecting growable files, for which such reads happen in
normal use cases. raw_pread_aligned already handles these cases and won't
return zero in the first place.

Signed-off-by: Kevin Wolf <[email protected]>
Signed-off-by: Anthony Liguori <[email protected]>

diff --git a/block/raw-posix.c b/block/raw-posix.c
index 96f26173ef8bf321f2df9ded97e8ae4ea4855ef6..7ce72e9e4e3d6b14868aee1f3492b251da99a319 100644 (file)
--- a/block/raw-posix.c
+++ b/block/raw-posix.c
@@ -391,8 +391,12 @@ static int raw_pread(BlockDriverState *bs, int64_t offset,
                     size = ALIGNED_BUFFER_SIZE;
 
                 ret = raw_pread_aligned(bs, offset, s->aligned_buf, size);
-                if (ret < 0)
+                if (ret < 0) {
                     return ret;
+                } else if (ret == 0) {
+                    fprintf(stderr, "raw_pread: read beyond end of file\n");
+                    abort();
+                }
 
                 size = ret;
                 if (size > count)