mirror of
https://gitlab.com/qemu-project/qemu
synced 2024-10-15 15:32:51 +00:00
parallels: Sanity check for s->tracks (CVE-2014-0142)
This avoids a possible division by zero. Convert s->tracks to unsigned as well because it feels better than surviving just because the results of calculations with s->tracks are converted to unsigned anyway. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
This commit is contained in:
parent
afbcc40bee
commit
9302e863aa
|
@ -51,7 +51,7 @@ typedef struct BDRVParallelsState {
|
||||||
uint32_t *catalog_bitmap;
|
uint32_t *catalog_bitmap;
|
||||||
unsigned int catalog_size;
|
unsigned int catalog_size;
|
||||||
|
|
||||||
int tracks;
|
unsigned int tracks;
|
||||||
} BDRVParallelsState;
|
} BDRVParallelsState;
|
||||||
|
|
||||||
static int parallels_probe(const uint8_t *buf, int buf_size, const char *filename)
|
static int parallels_probe(const uint8_t *buf, int buf_size, const char *filename)
|
||||||
|
@ -93,6 +93,11 @@ static int parallels_open(BlockDriverState *bs, QDict *options, int flags,
|
||||||
bs->total_sectors = le32_to_cpu(ph.nb_sectors);
|
bs->total_sectors = le32_to_cpu(ph.nb_sectors);
|
||||||
|
|
||||||
s->tracks = le32_to_cpu(ph.tracks);
|
s->tracks = le32_to_cpu(ph.tracks);
|
||||||
|
if (s->tracks == 0) {
|
||||||
|
error_setg(errp, "Invalid image: Zero sectors per track");
|
||||||
|
ret = -EINVAL;
|
||||||
|
goto fail;
|
||||||
|
}
|
||||||
|
|
||||||
s->catalog_size = le32_to_cpu(ph.catalog_entries);
|
s->catalog_size = le32_to_cpu(ph.catalog_entries);
|
||||||
if (s->catalog_size > INT_MAX / 4) {
|
if (s->catalog_size > INT_MAX / 4) {
|
||||||
|
|
|
@ -42,6 +42,7 @@ _supported_fmt parallels
|
||||||
_supported_proto generic
|
_supported_proto generic
|
||||||
_supported_os Linux
|
_supported_os Linux
|
||||||
|
|
||||||
|
tracks_offset=$((0x1c))
|
||||||
catalog_entries_offset=$((0x20))
|
catalog_entries_offset=$((0x20))
|
||||||
nb_sectors_offset=$((0x24))
|
nb_sectors_offset=$((0x24))
|
||||||
|
|
||||||
|
@ -63,6 +64,12 @@ poke_file "$TEST_IMG" "$nb_sectors_offset" "\xff\xff\xff\xff"
|
||||||
poke_file "$TEST_IMG" "$catalog_entries_offset" "\x01\x00\x00\x40"
|
poke_file "$TEST_IMG" "$catalog_entries_offset" "\x01\x00\x00\x40"
|
||||||
{ $QEMU_IO -c "read 64M 64M" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
|
{ $QEMU_IO -c "read 64M 64M" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
|
||||||
|
|
||||||
|
echo
|
||||||
|
echo "== Zero sectors per track =="
|
||||||
|
_use_sample_img fake.parallels.bz2
|
||||||
|
poke_file "$TEST_IMG" "$tracks_offset" "\x00\x00\x00\x00"
|
||||||
|
{ $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
|
||||||
|
|
||||||
# success, all done
|
# success, all done
|
||||||
echo "*** done"
|
echo "*** done"
|
||||||
rm -f $seq.full
|
rm -f $seq.full
|
||||||
|
|
|
@ -11,4 +11,8 @@ no file open, try 'help open'
|
||||||
== Overflow in catalog allocation ==
|
== Overflow in catalog allocation ==
|
||||||
qemu-io: can't open device TEST_DIR/fake.parallels: Catalog too large
|
qemu-io: can't open device TEST_DIR/fake.parallels: Catalog too large
|
||||||
no file open, try 'help open'
|
no file open, try 'help open'
|
||||||
|
|
||||||
|
== Zero sectors per track ==
|
||||||
|
qemu-io: can't open device TEST_DIR/fake.parallels: Invalid image: Zero sectors per track
|
||||||
|
no file open, try 'help open'
|
||||||
*** done
|
*** done
|
||||||
|
|
Loading…
Reference in a new issue