]> git.ipfire.org Git - thirdparty/qemu.git/commit
block: Limit request size (CVE-2014-0143)
authorKevin Wolf <kwolf@redhat.com>
Wed, 26 Mar 2014 12:06:02 +0000 (13:06 +0100)
committerMichael Roth <mdroth@linux.vnet.ibm.com>
Thu, 3 Jul 2014 21:18:13 +0000 (16:18 -0500)
commit759d38652ae6bbe1253b921c13c43d2c6c25b8d5
treebd83c7d71c75b85acaf292193074d7239cdc0428
parentb6f7fbdd1d9e27822e829e983fb6f907576a24e4
block: Limit request size (CVE-2014-0143)

Limiting the size of a single request to INT_MAX not only fixes a
direct integer overflow in bdrv_check_request() (which would only
trigger bad behaviour with ridiculously huge images, as in close to
2^64 bytes), but can also prevent overflows in all block drivers.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
(cherry picked from commit 8f4754ede56e3f9ea3fd7207f4a7c4453e59285b)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
block.c