diff options
| author | Kevin Wolf <kwolf@redhat.com> | 2014-03-26 13:06:09 +0100 |
|---|---|---|
| committer | Stefan Hajnoczi <stefanha@redhat.com> | 2014-04-01 15:22:35 +0200 |
| commit | 9302e863aa8baa5d932fc078967050c055fa1a7f (patch) | |
| tree | 1438bb12aa1447fbd965e1b4f09e55384c014743 /block/parallels.c | |
| parent | afbcc40bee4ef51731102d7d4b499ee12fc182e1 (diff) | |
| download | qemu-9302e863aa8baa5d932fc078967050c055fa1a7f.tar.gz | |
parallels: Sanity check for s->tracks (CVE-2014-0142)
This avoids a possible division by zero.
Convert s->tracks to unsigned as well because it feels better than
surviving just because the results of calculations with s->tracks are
converted to unsigned anyway.
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Diffstat (limited to 'block/parallels.c')
| -rw-r--r-- | block/parallels.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/block/parallels.c b/block/parallels.c index fe47ecb277..1a5bd350b3 100644 --- a/block/parallels.c +++ b/block/parallels.c @@ -51,7 +51,7 @@ typedef struct BDRVParallelsState { uint32_t *catalog_bitmap; unsigned int catalog_size; - int tracks; + unsigned int tracks; } BDRVParallelsState; static int parallels_probe(const uint8_t *buf, int buf_size, const char *filename) @@ -93,6 +93,11 @@ static int parallels_open(BlockDriverState *bs, QDict *options, int flags, bs->total_sectors = le32_to_cpu(ph.nb_sectors); s->tracks = le32_to_cpu(ph.tracks); + if (s->tracks == 0) { + error_setg(errp, "Invalid image: Zero sectors per track"); + ret = -EINVAL; + goto fail; + } s->catalog_size = le32_to_cpu(ph.catalog_entries); if (s->catalog_size > INT_MAX / 4) { |