From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:42040) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WV2Mn-0001BH-PI for qemu-devel@nongnu.org; Tue, 01 Apr 2014 13:21:01 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1WV2Mg-0003ER-6Q for qemu-devel@nongnu.org; Tue, 01 Apr 2014 13:20:53 -0400 Received: from mx1.redhat.com ([209.132.183.28]:9554) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WV2Mf-0003ED-Ge for qemu-devel@nongnu.org; Tue, 01 Apr 2014 13:20:45 -0400 From: Stefan Hajnoczi Date: Tue, 1 Apr 2014 19:18:58 +0200 Message-Id: <1396372769-11688-21-git-send-email-stefanha@redhat.com> In-Reply-To: <1396372769-11688-1-git-send-email-stefanha@redhat.com> References: <1396372769-11688-1-git-send-email-stefanha@redhat.com> Subject: [Qemu-devel] [PULL for-2.0 20/51] vhdx: Bounds checking for block_size and logical_sector_size (CVE-2014-0148) List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Kevin Wolf , Peter Maydell , Jeff Cody , Stefan Hajnoczi From: Jeff Cody Other variables (e.g. sectors_per_block) are calculated using these variables, and if not range-checked illegal values could be obtained causing infinite loops and other potential issues when calculating BAT entries. The 1.00 VHDX spec requires BlockSize to be min 1MB, max 256MB. LogicalSectorSize is required to be either 512 or 4096 bytes. Reported-by: Kevin Wolf Signed-off-by: Jeff Cody Signed-off-by: Kevin Wolf Reviewed-by: Max Reitz Signed-off-by: Stefan Hajnoczi --- block/vhdx.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/block/vhdx.c b/block/vhdx.c index 5390ba6..509baaf 100644 --- a/block/vhdx.c +++ b/block/vhdx.c @@ -780,12 +780,20 @@ static int vhdx_parse_metadata(BlockDriverState *bs, BDRVVHDXState *s) le32_to_cpus(&s->logical_sector_size); le32_to_cpus(&s->physical_sector_size); - if (s->logical_sector_size == 0 || s->params.block_size == 0) { + if (s->params.block_size < VHDX_BLOCK_SIZE_MIN || + s->params.block_size > VHDX_BLOCK_SIZE_MAX) { ret = -EINVAL; goto exit; } - /* both block_size and sector_size are guaranteed powers of 2 */ + /* only 2 supported sector sizes */ + if (s->logical_sector_size != 512 && s->logical_sector_size != 4096) { + ret = -EINVAL; + goto exit; + } + + /* Both block_size and sector_size are guaranteed powers of 2, below. + Due to range checks above, s->sectors_per_block can never be < 256 */ s->sectors_per_block = s->params.block_size / s->logical_sector_size; s->chunk_ratio = (VHDX_MAX_SECTORS_PER_BLOCK) * (uint64_t)s->logical_sector_size / -- 1.9.0