diff options
| author | Kevin Wolf <kwolf@redhat.com> | 2014-03-26 13:06:09 +0100 |
|---|---|---|
| committer | Michael Roth <mdroth@linux.vnet.ibm.com> | 2014-07-03 16:31:28 -0500 |
| commit | 97a0e27e719ad2d01420969adebb52f337fa6b94 (patch) | |
| tree | 126b4ed1d510e6dabbaa1c93ff464803328f965c /block | |
| parent | 750336bc908fd6e728d9ff127d532af70b4ff776 (diff) | |
| download | qemu-97a0e27e719ad2d01420969adebb52f337fa6b94.tar.gz | |
parallels: Sanity check for s->tracks (CVE-2014-0142)
This avoids a possible division by zero.
Convert s->tracks to unsigned as well because it feels better than
surviving just because the results of calculations with s->tracks are
converted to unsigned anyway.
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
(cherry picked from commit 9302e863aa8baa5d932fc078967050c055fa1a7f)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Diffstat (limited to 'block')
| -rw-r--r-- | block/parallels.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/block/parallels.c b/block/parallels.c index 5d1c0af354..d83cde4a2a 100644 --- a/block/parallels.c +++ b/block/parallels.c @@ -51,7 +51,7 @@ typedef struct BDRVParallelsState { uint32_t *catalog_bitmap; unsigned int catalog_size; - int tracks; + unsigned int tracks; } BDRVParallelsState; static int parallels_probe(const uint8_t *buf, int buf_size, const char *filename) @@ -92,6 +92,11 @@ static int parallels_open(BlockDriverState *bs, QDict *options, int flags, bs->total_sectors = le32_to_cpu(ph.nb_sectors); s->tracks = le32_to_cpu(ph.tracks); + if (s->tracks == 0) { + error_setg(errp, "Invalid image: Zero sectors per track"); + ret = -EINVAL; + goto fail; + } s->catalog_size = le32_to_cpu(ph.catalog_entries); if (s->catalog_size > INT_MAX / 4) { |