diff options
| author | Stefan Hajnoczi <stefanha@redhat.com> | 2014-03-26 13:05:28 +0100 |
|---|---|---|
| committer | Michael Roth <mdroth@linux.vnet.ibm.com> | 2014-07-03 16:18:10 -0500 |
| commit | 0fda3e2d639fee7c3262485c48c3b5fd6c9b4114 (patch) | |
| tree | 9ee28c276c0f00cce511601254b7c6dca88cc696 /tests | |
| parent | 7dcffbb2bfcb38c98cff911cd002c09e9326e3cc (diff) | |
| download | qemu-0fda3e2d639fee7c3262485c48c3b5fd6c9b4114.tar.gz | |
block/cloop: refuse images with bogus offsets (CVE-2014-0144)
The offsets[] array allows efficient seeking and tells us the maximum
compressed data size. If the offsets are bogus the maximum compressed
data size will be unrealistic.
This could cause g_malloc() to abort and bogus offsets mean the image is
broken anyway. Therefore we should refuse such images.
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
(cherry picked from commit f56b9bc3ae20fc93815b34aa022be919941406ce)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Diffstat (limited to 'tests')
| -rwxr-xr-x | tests/qemu-iotests/075 | 15 | ||||
| -rw-r--r-- | tests/qemu-iotests/075.out | 8 |
2 files changed, 23 insertions, 0 deletions
diff --git a/tests/qemu-iotests/075 b/tests/qemu-iotests/075 index 9c00fa8138..d74fb33272 100755 --- a/tests/qemu-iotests/075 +++ b/tests/qemu-iotests/075 @@ -44,6 +44,7 @@ _supported_os Linux block_size_offset=128 n_blocks_offset=132 +offsets_offset=136 echo echo "== check that the first sector can be read ==" @@ -80,6 +81,20 @@ _use_sample_img simple-pattern.cloop.bz2 poke_file "$TEST_IMG" "$n_blocks_offset" "\x04\x00\x00\x01" $QEMU_IO -c "read 0 512" $TEST_IMG 2>&1 | _filter_qemu_io | _filter_testdir +echo +echo "== refuse images with non-monotonically increasing offsets ==" +_use_sample_img simple-pattern.cloop.bz2 +poke_file "$TEST_IMG" "$offsets_offset" "\x00\x00\x00\x00\xff\xff\xff\xff" +poke_file "$TEST_IMG" $((offsets_offset + 8)) "\x00\x00\x00\x00\xff\xfe\x00\x00" +$QEMU_IO -c "read 0 512" $TEST_IMG 2>&1 | _filter_qemu_io | _filter_testdir + +echo +echo "== refuse images with invalid compressed block size ==" +_use_sample_img simple-pattern.cloop.bz2 +poke_file "$TEST_IMG" "$offsets_offset" "\x00\x00\x00\x00\x00\x00\x00\x00" +poke_file "$TEST_IMG" $((offsets_offset + 8)) "\xff\xff\xff\xff\xff\xff\xff\xff" +$QEMU_IO -c "read 0 512" $TEST_IMG 2>&1 | _filter_qemu_io | _filter_testdir + # success, all done echo "*** done" rm -f $seq.full diff --git a/tests/qemu-iotests/075.out b/tests/qemu-iotests/075.out index 7cdaee15ed..911cd3b4d8 100644 --- a/tests/qemu-iotests/075.out +++ b/tests/qemu-iotests/075.out @@ -23,4 +23,12 @@ no file open, try 'help open' == refuse images that require too many offsets === qemu-io: can't open device TEST_DIR/simple-pattern.cloop: image requires too many offsets, try increasing block size no file open, try 'help open' + +== refuse images with non-monotonically increasing offsets == +qemu-io: can't open device TEST_DIR/simple-pattern.cloop: offsets not monotonically increasing at index 1, image file is corrupt +no file open, try 'help open' + +== refuse images with invalid compressed block size == +qemu-io: can't open device TEST_DIR/simple-pattern.cloop: invalid compressed block size at index 1, image file is corrupt +no file open, try 'help open' *** done |