diff options
| author | Peter Wu <peter@lekensteyn.nl> | 2015-01-06 18:48:08 +0100 |
|---|---|---|
| committer | Kevin Wolf <kwolf@redhat.com> | 2015-02-06 17:24:21 +0100 |
| commit | f6e6652d7c9251236fc1ecc6cece36104c7af15b (patch) | |
| tree | 7d369a8801a35d11b5e3e73a93d92c1354a7bd14 /block/dmg.c | |
| parent | 7aee37b93a4f694cdd670807f30b8efd33d0c721 (diff) | |
| download | qemu-f6e6652d7c9251236fc1ecc6cece36104c7af15b.tar.gz | |
block/dmg: validate chunk size to avoid overflow
Previously the chunk size was not checked, allowing for a large memory
allocation. This patch checks whether the chunks size is within the
resource fork length, and whether the resource fork is below the
trailer of the dmg file.
Signed-off-by: Peter Wu <peter@lekensteyn.nl>
Reviewed-by: John Snow <jsnow@redhat.com>
Message-id: 1420566495-13284-6-git-send-email-peter@lekensteyn.nl
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Diffstat (limited to 'block/dmg.c')
| -rw-r--r-- | block/dmg.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/block/dmg.c b/block/dmg.c index 4f56227fc5..5c2c2c231d 100644 --- a/block/dmg.c +++ b/block/dmg.c @@ -317,7 +317,7 @@ static int dmg_read_resource_fork(BlockDriverState *bs, DmgHeaderState *ds, ret = read_uint32(bs, offset, &count); if (ret < 0) { goto fail; - } else if (count == 0) { + } else if (count == 0 || count > info_end - offset) { ret = -EINVAL; goto fail; } @@ -377,6 +377,11 @@ static int dmg_open(BlockDriverState *bs, QDict *options, int flags, if (ret < 0) { goto fail; } + if (rsrc_fork_offset >= offset || + rsrc_fork_length > offset - rsrc_fork_offset) { + ret = -EINVAL; + goto fail; + } if (rsrc_fork_length != 0) { ret = dmg_read_resource_fork(bs, &ds, rsrc_fork_offset, rsrc_fork_length); |