]> git.ipfire.org Git - thirdparty/qemu.git/commit
vpc/vhd: add bounds check for max_table_entries and block_size (CVE-2014-0144)
authorJeff Cody <jcody@redhat.com>
Wed, 26 Mar 2014 12:05:36 +0000 (13:05 +0100)
committerMichael Roth <mdroth@linux.vnet.ibm.com>
Thu, 3 Jul 2014 21:18:11 +0000 (16:18 -0500)
commitb2390c7008561c595127090688960a145a592f6b
treef5ce5eeeae4a8af6bea50bb9a5c818655d16c24e
parent6ee0d5fdc7bbeb5419fb41fd949fd0b0ebe085db
vpc/vhd: add bounds check for max_table_entries and block_size (CVE-2014-0144)

This adds checks to make sure that max_table_entries and block_size
are in sane ranges.  Memory is allocated based on max_table_entries,
and block_size is used to calculate indices into that allocated
memory, so if these values are incorrect that can lead to potential
unbounded memory allocation, or invalid memory accesses.

Also, the allocation of the pagetable is changed from g_malloc0()
to qemu_blockalign().

Signed-off-by: Jeff Cody <jcody@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
(cherry picked from commit 97f1c45c6f456572e5b504b8614e4a69e23b8e3a)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
block/vpc.c