ShuriZma
/
xemu
mirror of https://github.com/xemu-project/xemu.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

bochs: Use unsigned variables for offsets and sizes (CVE-2014-0147) 

Gets us rid of integer overflows resulting in negative sizes which
aren't correctly checked.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
This commit is contained in:
Kevin Wolf 2014-03-26 13:05:32 +01:00 committed by Stefan Hajnoczi
parent 3dd8a6763b
commit 246f65838d
3 changed files with 20 additions and 8 deletions
block
bochs.c
tests/qemu-iotests
078078.out

16
block/bochs.c
View File

@ -67,13 +67,13 @@ struct bochs_header {
typedef struct BDRVBochsState { typedef struct BDRVBochsState {
CoMutex lock; CoMutex lock;
uint32_t *catalog_bitmap; uint32_t *catalog_bitmap;
int catalog_size; uint32_t catalog_size;
int data_offset; uint32_t data_offset;
int bitmap_blocks; uint32_t bitmap_blocks;
int extent_blocks; uint32_t extent_blocks;
int extent_size; uint32_t extent_size;
} BDRVBochsState; } BDRVBochsState;
static int bochs_probe(const uint8_t *buf, int buf_size, const char *filename) static int bochs_probe(const uint8_t *buf, int buf_size, const char *filename)
@ -97,7 +97,7 @@ static int bochs_open(BlockDriverState *bs, QDict *options, int flags,
Error **errp) Error **errp)
{ {
BDRVBochsState *s = bs->opaque; BDRVBochsState *s = bs->opaque;
int i; uint32_t i;
struct bochs_header bochs; struct bochs_header bochs;
int ret; int ret;
@ -153,8 +153,8 @@ fail:
static int64_t seek_to_sector(BlockDriverState *bs, int64_t sector_num) static int64_t seek_to_sector(BlockDriverState *bs, int64_t sector_num)
{ {
BDRVBochsState *s = bs->opaque; BDRVBochsState *s = bs->opaque;
int64_t offset = sector_num * 512; uint64_t offset = sector_num * 512;
int64_t extent_index, extent_offset, bitmap_offset; uint64_t extent_index, extent_offset, bitmap_offset;
char bitmap_entry; char bitmap_entry;
// seek to sector // seek to sector

8
tests/qemu-iotests/078
View File

@ -42,11 +42,19 @@ _supported_fmt bochs
_supported_proto generic _supported_proto generic
_supported_os Linux _supported_os Linux
catalog_size_offset=$((0x48))
echo echo
echo "== Read from a valid image ==" echo "== Read from a valid image =="
_use_sample_img empty.bochs.bz2 _use_sample_img empty.bochs.bz2
{ $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir { $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
echo
echo "== Negative catalog size =="
_use_sample_img empty.bochs.bz2
poke_file "$TEST_IMG" "$catalog_size_offset" "\xff\xff\xff\xff"
{ $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
# success, all done # success, all done
echo "*** done" echo "*** done"
rm -f $seq.full rm -f $seq.full

4
tests/qemu-iotests/078.out
View File

@ -3,4 +3,8 @@ QA output created by 078
== Read from a valid image == == Read from a valid image ==
read 512/512 bytes at offset 0 read 512/512 bytes at offset 0
512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) 512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
== Negative catalog size ==
qemu-io: can't open device TEST_DIR/empty.bochs: Could not open 'TEST_DIR/empty.bochs': Interrupted system call
no file open, try 'help open'
*** done *** done