|
 |
f3a92ca |
From: Kevin Wolf <kwolf@redhat.com>
|
|
|
f3a92ca |
Date: Wed, 26 Mar 2014 13:05:46 +0100
|
|
|
f3a92ca |
Subject: [PATCH] qcow2: Validate active L1 table offset and size
|
|
|
f3a92ca |
(CVE-2014-0144)
|
|
|
f3a92ca |
|
|
|
f3a92ca |
This avoids an unbounded allocation.
|
|
|
f3a92ca |
|
|
|
f3a92ca |
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
|
|
|
f3a92ca |
Reviewed-by: Max Reitz <mreitz@redhat.com>
|
|
|
f3a92ca |
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
|
|
|
f3a92ca |
(cherry picked from commit 2d51c32c4b511db8bb9e58208f1e2c25e4c06c85)
|
|
|
f3a92ca |
|
|
|
f3a92ca |
Conflicts:
|
|
|
f3a92ca |
tests/qemu-iotests/080
|
|
|
f3a92ca |
tests/qemu-iotests/080.out
|
|
|
f3a92ca |
---
|
|
|
f3a92ca |
block/qcow2.c | 16 ++++++++++++++++
|
|
|
f3a92ca |
1 file changed, 16 insertions(+)
|
|
|
f3a92ca |
|
|
|
f3a92ca |
diff --git a/block/qcow2.c b/block/qcow2.c
|
|
|
f3a92ca |
index 43e2db1..8dd285b 100644
|
|
|
f3a92ca |
--- a/block/qcow2.c
|
|
|
f3a92ca |
+++ b/block/qcow2.c
|
|
|
f3a92ca |
@@ -520,6 +520,13 @@ static int qcow2_open(BlockDriverState *bs, QDict *options, int flags)
|
|
|
f3a92ca |
s->nb_snapshots = header.nb_snapshots;
|
|
|
f3a92ca |
|
|
|
f3a92ca |
/* read the level 1 table */
|
|
|
f3a92ca |
+ if (header.l1_size > 0x2000000) {
|
|
|
f3a92ca |
+ /* 32 MB L1 table is enough for 2 PB images at 64k cluster size
|
|
|
f3a92ca |
+ * (128 GB for 512 byte clusters, 2 EB for 2 MB clusters) */
|
|
|
f3a92ca |
+ fprintf(stderr, "Active L1 table too large");
|
|
|
f3a92ca |
+ ret = -EFBIG;
|
|
|
f3a92ca |
+ goto fail;
|
|
|
f3a92ca |
+ }
|
|
|
f3a92ca |
s->l1_size = header.l1_size;
|
|
|
f3a92ca |
|
|
|
f3a92ca |
l1_vm_state_index = size_to_l1(s, header.size);
|
|
|
f3a92ca |
@@ -535,7 +542,16 @@ static int qcow2_open(BlockDriverState *bs, QDict *options, int flags)
|
|
|
f3a92ca |
ret = -EINVAL;
|
|
|
f3a92ca |
goto fail;
|
|
|
f3a92ca |
}
|
|
|
f3a92ca |
+
|
|
|
f3a92ca |
+ ret = validate_table_offset(bs, header.l1_table_offset,
|
|
|
f3a92ca |
+ header.l1_size, sizeof(uint64_t));
|
|
|
f3a92ca |
+ if (ret < 0) {
|
|
|
f3a92ca |
+ fprintf(stderr, "Invalid L1 table offset");
|
|
|
f3a92ca |
+ goto fail;
|
|
|
f3a92ca |
+ }
|
|
|
f3a92ca |
s->l1_table_offset = header.l1_table_offset;
|
|
|
f3a92ca |
+
|
|
|
f3a92ca |
+
|
|
|
f3a92ca |
if (s->l1_size > 0) {
|
|
|
f3a92ca |
s->l1_table = g_malloc0(
|
|
|
f3a92ca |
align_offset(s->l1_size * sizeof(uint64_t), 512));
|