diff options
| author | Fam Zheng <famz@redhat.com> | 2013-08-06 15:44:52 +0800 |
|---|---|---|
| committer | Kevin Wolf <kwolf@redhat.com> | 2013-08-06 15:27:32 +0200 |
| commit | f8ce04036e333aae480b1d06d969f6436652633d (patch) | |
| tree | 983d5655f119ef0995ae0bdcd350b4fcb1ab4071 /block | |
| parent | 8aa1331c09a9b899f48d97f097bb49b7d458be1c (diff) | |
| download | qemu-f8ce04036e333aae480b1d06d969f6436652633d.tar.gz | |
vmdk: check l2 table size when opening
header.num_gtes_per_gte determines size for L2 table. Check for too big
value before using it. Limit to 512M entries (2GB per one L2 table).
Signed-off-by: Fam Zheng <famz@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Diffstat (limited to 'block')
| -rw-r--r-- | block/vmdk.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/block/vmdk.c b/block/vmdk.c index 015cbd4e60..53020ef3e3 100644 --- a/block/vmdk.c +++ b/block/vmdk.c @@ -585,6 +585,11 @@ static int vmdk_open_vmdk4(BlockDriverState *bs, return -ENOTSUP; } + if (le32_to_cpu(header.num_gtes_per_gte) > 512) { + error_report("L2 table size too big"); + return -EINVAL; + } + l1_entry_sectors = le32_to_cpu(header.num_gtes_per_gte) * le64_to_cpu(header.granularity); if (l1_entry_sectors == 0) { |