diff options
| author | Kevin Wolf <kwolf@redhat.com> | 2014-03-26 13:05:46 +0100 |
|---|---|---|
| committer | Michael Roth <mdroth@linux.vnet.ibm.com> | 2014-07-03 16:18:12 -0500 |
| commit | cd598d41616189f33b35f69a5f7ba70c8112c272 (patch) | |
| tree | 2b105d1f1cce1e4501c4dd4bb421c171368e1a0c /block | |
| parent | 04bc6981ca7ea65d9d4e61b4758dcb9336fd045d (diff) | |
| download | qemu-cd598d41616189f33b35f69a5f7ba70c8112c272.tar.gz | |
qcow2: Validate active L1 table offset and size (CVE-2014-0144)
This avoids an unbounded allocation.
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
(cherry picked from commit 2d51c32c4b511db8bb9e58208f1e2c25e4c06c85)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Diffstat (limited to 'block')
| -rw-r--r-- | block/qcow2.c | 16 |
1 files changed, 16 insertions, 0 deletions
diff --git a/block/qcow2.c b/block/qcow2.c index 3b81c53e53..f1f8c9c340 100644 --- a/block/qcow2.c +++ b/block/qcow2.c @@ -644,6 +644,13 @@ static int qcow2_open(BlockDriverState *bs, QDict *options, int flags, s->nb_snapshots = header.nb_snapshots; /* read the level 1 table */ + if (header.l1_size > 0x2000000) { + /* 32 MB L1 table is enough for 2 PB images at 64k cluster size + * (128 GB for 512 byte clusters, 2 EB for 2 MB clusters) */ + error_setg(errp, "Active L1 table too large"); + ret = -EFBIG; + goto fail; + } s->l1_size = header.l1_size; l1_vm_state_index = size_to_l1(s, header.size); @@ -661,7 +668,16 @@ static int qcow2_open(BlockDriverState *bs, QDict *options, int flags, ret = -EINVAL; goto fail; } + + ret = validate_table_offset(bs, header.l1_table_offset, + header.l1_size, sizeof(uint64_t)); + if (ret < 0) { + error_setg(errp, "Invalid L1 table offset"); + goto fail; + } s->l1_table_offset = header.l1_table_offset; + + if (s->l1_size > 0) { s->l1_table = g_malloc0( align_offset(s->l1_size * sizeof(uint64_t), 512)); |