motorhead/qemu
1
0
Fork 0
mirror of https://github.com/Motorhead1991/qemu.git synced 2025-08-06 01:03:55 -06:00
Code Issues Projects Releases Packages Wiki Activity Actions

qcow2: Check maximum L1 size in qcow2_snapshot_load_tmp() (CVE-2014-0143)

Browse source 
This avoids an unbounded allocation.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
This commit is contained in:
Kevin Wolf 2014-03-26 13:06:06 +01:00 • committed by Stefan Hajnoczi
parent c05e4667be
commit 6a83f8b5be
5 changed files with 29 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

15
tests/qemu-iotests/080
View file

@ -30,7 +30,8 @@ status=1 # failure is the default!
_cleanup()
{
_cleanup_test_img
rm -f $TEST_IMG.snap
_cleanup_test_img
}
trap "_cleanup; exit \$status" 0 1 2 3 15
@ -58,6 +59,10 @@ offset_ext_size=$((header_size + 4))
offset_l2_table_0=$((0x40000))
offset_snap1=$((0x70000))
offset_snap1_l1_offset=$((offset_snap1 + 0))
offset_snap1_l1_size=$((offset_snap1 + 8))
echo
echo "== Huge header size =="
_make_test_img 64M
@ -161,6 +166,14 @@ poke_file "$TEST_IMG" "$offset_l2_table_0" "\xbf\xff\xff\xff\xff\xff\x00\x00"
poke_file "$TEST_IMG" "$offset_l2_table_0" "\x80\x00\x00\xff\xff\xff\x00\x00"
{ $QEMU_IMG snapshot -c test $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
echo
echo "== Invalid snapshot L1 table =="
_make_test_img 64M
{ $QEMU_IO -c "write 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
{ $QEMU_IMG snapshot -c test $TEST_IMG; } 2>&1 | _filter_testdir
poke_file "$TEST_IMG" "$offset_snap1_l1_size" "\x10\x00\x00\x00"
{ $QEMU_IMG convert -s test $TEST_IMG $TEST_IMG.snap; } 2>&1 | _filter_testdir
# success, all done
echo "*** done"
rm -f $seq.full