From 34df3eaebbf503a1eda6a6d64b5dbdf57475c517 Mon Sep 17 00:00:00 2001 From: Peter Wu Date: Fri, 26 Dec 2014 13:16:48 +0100 Subject: block/dmg: validate chunk size to avoid overflow Previously the chunk size was not checked, allowing for a large memory allocation. This patch checks whether the chunks size is within the resource fork length. Signed-off-by: Peter Wu --- block/dmg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/block/dmg.c b/block/dmg.c index 75e771af40..19e4fe2b19 100644 --- a/block/dmg.c +++ b/block/dmg.c @@ -308,7 +308,7 @@ static int dmg_read_resource_fork(BlockDriverState *bs, DmgHeaderState *ds, ret = read_uint32(bs, offset, &count); if (ret < 0) { goto fail; - } else if (count == 0) { + } else if (count == 0 || count > info_end - offset) { ret = -EINVAL; goto fail; } -- cgit v1.2.1