62 lines
2.3 KiB
Diff
62 lines
2.3 KiB
Diff
From: Kevin Wolf <kwolf@redhat.com>
|
|
Date: Wed, 26 Mar 2014 13:05:43 +0100
|
|
Subject: [PATCH] qcow2: Check refcount table size (CVE-2014-0144)
|
|
|
|
Limit the in-memory reference count table size to 8 MB, it's enough in
|
|
practice. This fixes an unbounded allocation as well as a buffer
|
|
overflow in qcow2_refcount_init().
|
|
|
|
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
|
|
Reviewed-by: Max Reitz <mreitz@redhat.com>
|
|
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
|
|
(cherry picked from commit 5dab2faddc8eaa1fb1abdbe2f502001fc13a1b21)
|
|
|
|
Conflicts:
|
|
tests/qemu-iotests/080
|
|
tests/qemu-iotests/080.out
|
|
---
|
|
block/qcow2-refcount.c | 4 +++-
|
|
block/qcow2.c | 9 +++++++++
|
|
2 files changed, 12 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/block/qcow2-refcount.c b/block/qcow2-refcount.c
|
|
index 1244693..cd641c9 100644
|
|
--- a/block/qcow2-refcount.c
|
|
+++ b/block/qcow2-refcount.c
|
|
@@ -38,8 +38,10 @@ static int QEMU_WARN_UNUSED_RESULT update_refcount(BlockDriverState *bs,
|
|
int qcow2_refcount_init(BlockDriverState *bs)
|
|
{
|
|
BDRVQcowState *s = bs->opaque;
|
|
- int ret, refcount_table_size2, i;
|
|
+ unsigned int refcount_table_size2, i;
|
|
+ int ret;
|
|
|
|
+ assert(s->refcount_table_size <= INT_MAX / sizeof(uint64_t));
|
|
refcount_table_size2 = s->refcount_table_size * sizeof(uint64_t);
|
|
s->refcount_table = g_malloc(refcount_table_size2);
|
|
if (s->refcount_table_size > 0) {
|
|
diff --git a/block/qcow2.c b/block/qcow2.c
|
|
index 4392111..884262b 100644
|
|
--- a/block/qcow2.c
|
|
+++ b/block/qcow2.c
|
|
@@ -455,10 +455,19 @@ static int qcow2_open(BlockDriverState *bs, QDict *options, int flags)
|
|
s->csize_shift = (62 - (s->cluster_bits - 8));
|
|
s->csize_mask = (1 << (s->cluster_bits - 8)) - 1;
|
|
s->cluster_offset_mask = (1LL << s->csize_shift) - 1;
|
|
+
|
|
s->refcount_table_offset = header.refcount_table_offset;
|
|
s->refcount_table_size =
|
|
header.refcount_table_clusters << (s->cluster_bits - 3);
|
|
|
|
+ if (header.refcount_table_clusters > (0x800000 >> s->cluster_bits)) {
|
|
+ /* 8 MB refcount table is enough for 2 PB images at 64k cluster size
|
|
+ * (128 GB for 512 byte clusters, 2 EB for 2 MB clusters) */
|
|
+ fprintf(stderr, "Reference count table too large");
|
|
+ ret = -EINVAL;
|
|
+ goto fail;
|
|
+ }
|
|
+
|
|
s->snapshots_offset = header.snapshots_offset;
|
|
s->nb_snapshots = header.nb_snapshots;
|
|
|