f3a92caa76
CVE-2014-0150: virtio-net: buffer overflow in virtio_net_handle_mac() function (bz #1086775, bz #1078846) CVE-2013-4544: vmxnet3: bounds checking buffer overrun (bz #1087513, bz #1087522) CVE-2014-2894: out of bounds buffer accesses, guest triggerable via IDE SMART (bz #1087981, bz #1087971)
56 lines
1.8 KiB
Diff
56 lines
1.8 KiB
Diff
From 24658f7b83bdd8a09cc622085d1259f26ee38b43 Mon Sep 17 00:00:00 2001
|
|
From: Kevin Wolf <kwolf@redhat.com>
|
|
Date: Wed, 26 Mar 2014 13:05:46 +0100
|
|
Subject: [PATCH] qcow2: Validate active L1 table offset and size
|
|
(CVE-2014-0144)
|
|
|
|
This avoids an unbounded allocation.
|
|
|
|
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
|
|
Reviewed-by: Max Reitz <mreitz@redhat.com>
|
|
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
|
|
(cherry picked from commit 2d51c32c4b511db8bb9e58208f1e2c25e4c06c85)
|
|
|
|
Conflicts:
|
|
tests/qemu-iotests/080
|
|
tests/qemu-iotests/080.out
|
|
---
|
|
block/qcow2.c | 16 ++++++++++++++++
|
|
1 file changed, 16 insertions(+)
|
|
|
|
diff --git a/block/qcow2.c b/block/qcow2.c
|
|
index 43e2db1..8dd285b 100644
|
|
--- a/block/qcow2.c
|
|
+++ b/block/qcow2.c
|
|
@@ -520,6 +520,13 @@ static int qcow2_open(BlockDriverState *bs, QDict *options, int flags)
|
|
s->nb_snapshots = header.nb_snapshots;
|
|
|
|
/* read the level 1 table */
|
|
+ if (header.l1_size > 0x2000000) {
|
|
+ /* 32 MB L1 table is enough for 2 PB images at 64k cluster size
|
|
+ * (128 GB for 512 byte clusters, 2 EB for 2 MB clusters) */
|
|
+ fprintf(stderr, "Active L1 table too large");
|
|
+ ret = -EFBIG;
|
|
+ goto fail;
|
|
+ }
|
|
s->l1_size = header.l1_size;
|
|
|
|
l1_vm_state_index = size_to_l1(s, header.size);
|
|
@@ -535,7 +542,16 @@ static int qcow2_open(BlockDriverState *bs, QDict *options, int flags)
|
|
ret = -EINVAL;
|
|
goto fail;
|
|
}
|
|
+
|
|
+ ret = validate_table_offset(bs, header.l1_table_offset,
|
|
+ header.l1_size, sizeof(uint64_t));
|
|
+ if (ret < 0) {
|
|
+ fprintf(stderr, "Invalid L1 table offset");
|
|
+ goto fail;
|
|
+ }
|
|
s->l1_table_offset = header.l1_table_offset;
|
|
+
|
|
+
|
|
if (s->l1_size > 0) {
|
|
s->l1_table = g_malloc0(
|
|
align_offset(s->l1_size * sizeof(uint64_t), 512));
|