From 5e71dfad763d67bb64be79e20e93411c0c30ad25 Mon Sep 17 00:00:00 2001 From: Kevin Wolf Date: Wed, 26 Mar 2014 13:05:37 +0100 Subject: vpc: Validate block size (CVE-2014-0142) This fixes some cases of division by zero crashes. Signed-off-by: Kevin Wolf Reviewed-by: Max Reitz Signed-off-by: Stefan Hajnoczi --- block/vpc.c | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'block/vpc.c') diff --git a/block/vpc.c b/block/vpc.c index ba82d4869b..2e25f57230 100644 --- a/block/vpc.c +++ b/block/vpc.c @@ -245,6 +245,11 @@ static int vpc_open(BlockDriverState *bs, QDict *options, int flags, } s->block_size = be32_to_cpu(dyndisk_header->block_size); + if (!is_power_of_2(s->block_size) || s->block_size < BDRV_SECTOR_SIZE) { + error_setg(errp, "Invalid block size %" PRIu32, s->block_size); + ret = -EINVAL; + goto fail; + } s->bitmap_size = ((s->block_size / (8 * 512)) + 511) & ~511; s->max_table_entries = be32_to_cpu(dyndisk_header->max_table_entries); -- cgit v1.2.1