ShuriZma
/
xqemu
mirror of https://github.com/xqemu/xqemu.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

vmdk: check l2 table size when opening 

header.num_gtes_per_gte determines size for L2 table. Check for too big
value before using it. Limit to 512M entries (2GB per one L2 table).

Signed-off-by: Fam Zheng <famz@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
This commit is contained in:
Fam Zheng 2013-08-06 15:44:52 +08:00 committed by Kevin Wolf
parent 8aa1331c09
commit f8ce04036e
3 changed files with 18 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
block/vmdk.c
View File

@ -585,6 +585,11 @@ static int vmdk_open_vmdk4(BlockDriverState *bs,
return -ENOTSUP; return -ENOTSUP;
} }
if (le32_to_cpu(header.num_gtes_per_gte) > 512) {
error_report("L2 table size too big");
return -EINVAL;
}
l1_entry_sectors = le32_to_cpu(header.num_gtes_per_gte) l1_entry_sectors = le32_to_cpu(header.num_gtes_per_gte)
* le64_to_cpu(header.granularity); * le64_to_cpu(header.granularity);
if (l1_entry_sectors == 0) { if (l1_entry_sectors == 0) {

7
tests/qemu-iotests/059
View File

@ -44,6 +44,7 @@ _supported_proto generic
_supported_os Linux _supported_os Linux
granularity_offset=20 granularity_offset=20
grain_table_size_offset=44
echo "=== Testing invalid granularity ===" echo "=== Testing invalid granularity ==="
echo echo
@ -51,6 +52,12 @@ _make_test_img 64M
poke_file "$TEST_IMG" "$granularity_offset" "\xff\xff\xff\xff\xff\xff\xff\xff" poke_file "$TEST_IMG" "$granularity_offset" "\xff\xff\xff\xff\xff\xff\xff\xff"
{ $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir { $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
echo "=== Testing too big L2 table size ==="
echo
_make_test_img 64M
poke_file "$TEST_IMG" "$grain_table_size_offset" "\xff\xff\xff\xff"
{ $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
# success, all done # success, all done
echo "*** done" echo "*** done"
rm -f $seq.full rm -f $seq.full

6
tests/qemu-iotests/059.out
View File

@ -5,4 +5,10 @@ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864
invalid granularity, image may be corrupt invalid granularity, image may be corrupt
qemu-io: can't open device TEST_DIR/t.vmdk qemu-io: can't open device TEST_DIR/t.vmdk
no file open, try 'help open' no file open, try 'help open'
=== Testing too big L2 table size ===
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864
L2 table size too big
qemu-io: can't open device TEST_DIR/t.vmdk
no file open, try 'help open'
*** done *** done