48 lines
1.5 KiB
Diff
48 lines
1.5 KiB
Diff
From: Kevin Wolf <kwolf@redhat.com>
|
|
Date: Wed, 26 Mar 2014 13:06:09 +0100
|
|
Subject: [PATCH] parallels: Sanity check for s->tracks (CVE-2014-0142)
|
|
|
|
This avoids a possible division by zero.
|
|
|
|
Convert s->tracks to unsigned as well because it feels better than
|
|
surviving just because the results of calculations with s->tracks are
|
|
converted to unsigned anyway.
|
|
|
|
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
|
|
Reviewed-by: Max Reitz <mreitz@redhat.com>
|
|
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
|
|
(cherry picked from commit 9302e863aa8baa5d932fc078967050c055fa1a7f)
|
|
|
|
Conflicts:
|
|
tests/qemu-iotests/076
|
|
tests/qemu-iotests/076.out
|
|
---
|
|
block/parallels.c | 7 ++++++-
|
|
1 file changed, 6 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/block/parallels.c b/block/parallels.c
|
|
index bad47f4..4bcfe06 100644
|
|
--- a/block/parallels.c
|
|
+++ b/block/parallels.c
|
|
@@ -51,7 +51,7 @@ typedef struct BDRVParallelsState {
|
|
uint32_t *catalog_bitmap;
|
|
unsigned int catalog_size;
|
|
|
|
- int tracks;
|
|
+ unsigned int tracks;
|
|
} BDRVParallelsState;
|
|
|
|
static int parallels_probe(const uint8_t *buf, int buf_size, const char *filename)
|
|
@@ -91,6 +91,11 @@ static int parallels_open(BlockDriverState *bs, QDict *options, int flags)
|
|
bs->total_sectors = le32_to_cpu(ph.nb_sectors);
|
|
|
|
s->tracks = le32_to_cpu(ph.tracks);
|
|
+ if (s->tracks == 0) {
|
|
+ fprintf(stderr, "Invalid image: Zero sectors per track");
|
|
+ ret = -EINVAL;
|
|
+ goto fail;
|
|
+ }
|
|
|
|
s->catalog_size = le32_to_cpu(ph.catalog_entries);
|
|
if (s->catalog_size > INT_MAX / 4) {
|