motorhead/qemu
1
0
Fork 0
mirror of https://github.com/Motorhead1991/qemu.git synced 2025-08-09 02:24:58 -06:00
Code Issues Projects Releases Packages Wiki Activity Actions

parallels: Fix catalog size integer overflow (CVE-2014-0143)

Browse source 
The first test case would cause a huge memory allocation, leading to a
qemu abort; the second one to a too small malloc() for the catalog
(smaller than s->catalog_size), which causes a read-only out-of-bounds
array access and on big endian hosts an endianess conversion for an
undefined memory area.

The sample image used here is not an original Parallels image. It was
created using an hexeditor on the basis of the struct that qemu uses.
Good enough for trying to crash the driver, but not for ensuring
compatibility.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
This commit is contained in:
Kevin Wolf 2014-03-26 13:06:08 +01:00 • committed by Stefan Hajnoczi
parent 5dae6e30c5
commit afbcc40bee
6 changed files with 97 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

14
tests/qemu-iotests/076.out Normal file
View file

@ -0,0 +1,14 @@
QA output created by 076
== Read from a valid (enough) image ==
read 65536/65536 bytes at offset 0
64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
== Negative catalog size ==
qemu-io: can't open device TEST_DIR/fake.parallels: Catalog too large
no file open, try 'help open'
== Overflow in catalog allocation ==
qemu-io: can't open device TEST_DIR/fake.parallels: Catalog too large
no file open, try 'help open'
*** done