From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:34590) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1S2KCs-0002br-K2 for qemu-devel@nongnu.org; Tue, 28 Feb 2012 05:23:01 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1S2KCm-0004HW-Et for qemu-devel@nongnu.org; Tue, 28 Feb 2012 05:22:54 -0500 Received: from mx1.redhat.com ([209.132.183.28]:35749) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1S2KCm-0004HL-7I for qemu-devel@nongnu.org; Tue, 28 Feb 2012 05:22:48 -0500 From: Kevin Wolf Date: Tue, 28 Feb 2012 11:26:15 +0100 Message-Id: <1330424775-12070-1-git-send-email-kwolf@redhat.com> Subject: [Qemu-devel] [PATCH v2] qcow2: Reject too large header extensions List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: kwolf@redhat.com, stefanha@gmail.com Image files that make qemu-img info read several gigabytes into the unknown header extensions list are bad. Just fail opening the image if an extension claims to be larger than the header extension area. Signed-off-by: Kevin Wolf --- block/qcow2.c | 5 +++++ 1 files changed, 5 insertions(+), 0 deletions(-) diff --git a/block/qcow2.c b/block/qcow2.c index f68f0e1..eb5ea48 100644 --- a/block/qcow2.c +++ b/block/qcow2.c @@ -108,6 +108,11 @@ static int qcow2_read_extensions(BlockDriverState *bs, uint64_t start_offset, #ifdef DEBUG_EXT printf("ext.magic = 0x%x\n", ext.magic); #endif + if (ext.len > end_offset - offset) { + error_report("Header extension too large"); + return -EINVAL; + } + switch (ext.magic) { case QCOW2_EXT_MAGIC_END: return 0; -- 1.7.6.5