Re: [Qemu-devel] [PATCH v2 05/12] block/dmg: validate chunk size to avoid overflow

[John Snow <jsnow@redhat.com>]

On 01/06/2015 12:48 PM, Peter Wu wrote:
> Previously the chunk size was not checked, allowing for a large memory
> allocation. This patch checks whether the chunks size is within the
> resource fork length, and whether the resource fork is below the
> trailer of the dmg file.
>
> Signed-off-by: Peter Wu <peter@lekensteyn.nl>
> ---
>   v2: added resource fork offset check
> ---
>   block/dmg.c | 7 ++++++-
>   1 file changed, 6 insertions(+), 1 deletion(-)
>
> diff --git a/block/dmg.c b/block/dmg.c
> index 4913249..5f6976b 100644
> --- a/block/dmg.c
> +++ b/block/dmg.c
> @@ -319,7 +319,7 @@ static int dmg_read_resource_fork(BlockDriverState *bs, DmgHeaderState *ds,
>           ret = read_uint32(bs, offset, &count);
>           if (ret < 0) {
>               goto fail;
> -        } else if (count == 0) {
> +        } else if (count == 0 || count > info_end - offset) {
>               ret = -EINVAL;
>               goto fail;
>           }
> @@ -379,6 +379,11 @@ static int dmg_open(BlockDriverState *bs, QDict *options, int flags,
>       if (ret < 0) {
>           goto fail;
>       }
> +    if (rsrc_fork_offset >= offset ||
> +        rsrc_fork_length > offset - rsrc_fork_offset) {
> +        ret = -EINVAL;
> +        goto fail;
> +    }
>       if (rsrc_fork_length != 0) {
>           ret = dmg_read_resource_fork(bs, &ds,
>                                        rsrc_fork_offset, rsrc_fork_length);
>

Reviewed-by: John Snow <jsnow@redhat.com>