46f3a5c276
CVE-2014-3640 qemu: slirp: NULL pointer (bz #1144821, bz #1144818)
97 lines
3.2 KiB
Diff
97 lines
3.2 KiB
Diff
From 6665e04d68d58a93d75a51a0840534f3a0ad2402 Mon Sep 17 00:00:00 2001
|
|
From: "Richard W.M. Jones" <rjones@redhat.com>
|
|
Date: Tue, 19 Aug 2014 18:56:28 +0100
|
|
Subject: [PATCH] loader: Add load_image_gzipped function.
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
As the name suggests this lets you load a ROM/disk image that is
|
|
gzipped. It is uncompressed before storing it in guest memory.
|
|
|
|
Signed-off-by: Richard W.M. Jones <rjones@redhat.com>
|
|
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
|
|
Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
|
|
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
|
|
Message-id: 1407831259-2115-2-git-send-email-rjones@redhat.com
|
|
[PMM: removed stray space before ')']
|
|
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
|
|
|
|
(cherry picked from commit 235e74afcb85285a8e35e75f0cb6e6811267bb75)
|
|
---
|
|
hw/core/loader.c | 48 ++++++++++++++++++++++++++++++++++++++++++++++++
|
|
include/hw/loader.h | 1 +
|
|
2 files changed, 49 insertions(+)
|
|
|
|
diff --git a/hw/core/loader.c b/hw/core/loader.c
|
|
index 2bf6b8f..0fde699 100644
|
|
--- a/hw/core/loader.c
|
|
+++ b/hw/core/loader.c
|
|
@@ -577,6 +577,54 @@ int load_ramdisk(const char *filename, hwaddr addr, uint64_t max_sz)
|
|
return load_uboot_image(filename, NULL, &addr, NULL, IH_TYPE_RAMDISK);
|
|
}
|
|
|
|
+/* This simply prevents g_malloc in the function below from allocating
|
|
+ * a huge amount of memory, by placing a limit on the maximum
|
|
+ * uncompressed image size that load_image_gzipped will read.
|
|
+ */
|
|
+#define LOAD_IMAGE_MAX_GUNZIP_BYTES (256 << 20)
|
|
+
|
|
+/* Load a gzip-compressed kernel. */
|
|
+int load_image_gzipped(const char *filename, hwaddr addr, uint64_t max_sz)
|
|
+{
|
|
+ uint8_t *compressed_data = NULL;
|
|
+ uint8_t *data = NULL;
|
|
+ gsize len;
|
|
+ ssize_t bytes;
|
|
+ int ret = -1;
|
|
+
|
|
+ if (!g_file_get_contents(filename, (char **) &compressed_data, &len,
|
|
+ NULL)) {
|
|
+ goto out;
|
|
+ }
|
|
+
|
|
+ /* Is it a gzip-compressed file? */
|
|
+ if (len < 2 ||
|
|
+ compressed_data[0] != 0x1f ||
|
|
+ compressed_data[1] != 0x8b) {
|
|
+ goto out;
|
|
+ }
|
|
+
|
|
+ if (max_sz > LOAD_IMAGE_MAX_GUNZIP_BYTES) {
|
|
+ max_sz = LOAD_IMAGE_MAX_GUNZIP_BYTES;
|
|
+ }
|
|
+
|
|
+ data = g_malloc(max_sz);
|
|
+ bytes = gunzip(data, max_sz, compressed_data, len);
|
|
+ if (bytes < 0) {
|
|
+ fprintf(stderr, "%s: unable to decompress gzipped kernel file\n",
|
|
+ filename);
|
|
+ goto out;
|
|
+ }
|
|
+
|
|
+ rom_add_blob_fixed(filename, data, bytes, addr);
|
|
+ ret = bytes;
|
|
+
|
|
+ out:
|
|
+ g_free(compressed_data);
|
|
+ g_free(data);
|
|
+ return ret;
|
|
+}
|
|
+
|
|
/*
|
|
* Functions for reboot-persistent memory regions.
|
|
* - used for vga bios and option roms.
|
|
diff --git a/include/hw/loader.h b/include/hw/loader.h
|
|
index 796cbf9..00c9117 100644
|
|
--- a/include/hw/loader.h
|
|
+++ b/include/hw/loader.h
|
|
@@ -15,6 +15,7 @@ int get_image_size(const char *filename);
|
|
int load_image(const char *filename, uint8_t *addr); /* deprecated */
|
|
int load_image_targphys(const char *filename, hwaddr,
|
|
uint64_t max_sz);
|
|
+int load_image_gzipped(const char *filename, hwaddr addr, uint64_t max_sz);
|
|
|
|
#define ELF_LOAD_FAILED -1
|
|
#define ELF_LOAD_NOT_ELF -2
|