f3a92caa76
CVE-2014-0150: virtio-net: buffer overflow in virtio_net_handle_mac() function (bz #1086775, bz #1078846) CVE-2013-4544: vmxnet3: bounds checking buffer overrun (bz #1087513, bz #1087522) CVE-2014-2894: out of bounds buffer accesses, guest triggerable via IDE SMART (bz #1087981, bz #1087971)
49 lines
1.6 KiB
Diff
49 lines
1.6 KiB
Diff
From 100635f1b07d0a3c2ea4045fa374c0ce0cd176bf Mon Sep 17 00:00:00 2001
|
|
From: Kevin Wolf <kwolf@redhat.com>
|
|
Date: Wed, 26 Mar 2014 13:06:09 +0100
|
|
Subject: [PATCH] parallels: Sanity check for s->tracks (CVE-2014-0142)
|
|
|
|
This avoids a possible division by zero.
|
|
|
|
Convert s->tracks to unsigned as well because it feels better than
|
|
surviving just because the results of calculations with s->tracks are
|
|
converted to unsigned anyway.
|
|
|
|
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
|
|
Reviewed-by: Max Reitz <mreitz@redhat.com>
|
|
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
|
|
(cherry picked from commit 9302e863aa8baa5d932fc078967050c055fa1a7f)
|
|
|
|
Conflicts:
|
|
tests/qemu-iotests/076
|
|
tests/qemu-iotests/076.out
|
|
---
|
|
block/parallels.c | 7 ++++++-
|
|
1 file changed, 6 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/block/parallels.c b/block/parallels.c
|
|
index bad47f4..4bcfe06 100644
|
|
--- a/block/parallels.c
|
|
+++ b/block/parallels.c
|
|
@@ -51,7 +51,7 @@ typedef struct BDRVParallelsState {
|
|
uint32_t *catalog_bitmap;
|
|
unsigned int catalog_size;
|
|
|
|
- int tracks;
|
|
+ unsigned int tracks;
|
|
} BDRVParallelsState;
|
|
|
|
static int parallels_probe(const uint8_t *buf, int buf_size, const char *filename)
|
|
@@ -91,6 +91,11 @@ static int parallels_open(BlockDriverState *bs, QDict *options, int flags)
|
|
bs->total_sectors = le32_to_cpu(ph.nb_sectors);
|
|
|
|
s->tracks = le32_to_cpu(ph.tracks);
|
|
+ if (s->tracks == 0) {
|
|
+ fprintf(stderr, "Invalid image: Zero sectors per track");
|
|
+ ret = -EINVAL;
|
|
+ goto fail;
|
|
+ }
|
|
|
|
s->catalog_size = le32_to_cpu(ph.catalog_entries);
|
|
if (s->catalog_size > INT_MAX / 4) {
|