From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:35538) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Y4ssX-0006Wx-35 for qemu-devel@nongnu.org; Sat, 27 Dec 2014 10:02:06 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1Y4ssI-0000O9-S8 for qemu-devel@nongnu.org; Sat, 27 Dec 2014 10:02:05 -0500 Received: from mail.lekensteyn.nl ([2a02:2308::360:1:25]:59965) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Y4ssI-0000Nl-IC for qemu-devel@nongnu.org; Sat, 27 Dec 2014 10:01:50 -0500 From: Peter Wu Date: Sat, 27 Dec 2014 16:01:37 +0100 Message-Id: <1419692504-29373-4-git-send-email-peter@lekensteyn.nl> In-Reply-To: <1419692504-29373-1-git-send-email-peter@lekensteyn.nl> References: <1419692504-29373-1-git-send-email-peter@lekensteyn.nl> Subject: [Qemu-devel] [PATCH 03/10] block/dmg: extract processing of resource forks List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Kevin Wolf , Stefan Hajnoczi Besides the offset, also read the resource length. This length is now used in the extracted function to verify the end of the resource fork against "count" from the resource fork. Signed-off-by: Peter Wu --- block/dmg.c | 90 ++++++++++++++++++++++++++++++++++++++++--------------------- 1 file changed, 59 insertions(+), 31 deletions(-) diff --git a/block/dmg.c b/block/dmg.c index 6dc6dbb..7f49388 100644 --- a/block/dmg.c +++ b/block/dmg.c @@ -278,38 +278,13 @@ fail: return ret; } -static int dmg_open(BlockDriverState *bs, QDict *options, int flags, - Error **errp) +static int dmg_read_resource_fork(BlockDriverState *bs, DmgHeaderState *ds, + uint64_t info_begin, uint64_t info_length) { - BDRVDMGState *s = bs->opaque; - DmgHeaderState ds; - uint64_t info_begin, info_end; - uint32_t count, tmp; - int64_t offset; int ret; - - bs->read_only = 1; - s->n_chunks = 0; - s->offsets = s->lengths = s->sectors = s->sectorcounts = NULL; - ds.last_in_offset = 0; - ds.last_out_offset = 0; - ds.max_compressed_size = 1; - ds.max_sectors_per_chunk = 1; - - /* locate the UDIF trailer */ - offset = dmg_find_koly_offset(bs->file); - if (offset < 0) { - ret = offset; - goto fail; - } - - ret = read_uint64(bs, offset + 0x28, &info_begin); - if (ret < 0) { - goto fail; - } else if (info_begin == 0) { - ret = -EINVAL; - goto fail; - } + uint32_t count, tmp; + uint64_t info_end; + uint64_t offset; ret = read_uint32(bs, info_begin, &tmp); if (ret < 0) { @@ -326,6 +301,10 @@ static int dmg_open(BlockDriverState *bs, QDict *options, int flags, ret = -EINVAL; goto fail; } + if (count > info_length) { + ret = -EINVAL; + goto fail; + } info_end = info_begin + count; /* begin of mish block */ @@ -342,12 +321,61 @@ static int dmg_open(BlockDriverState *bs, QDict *options, int flags, } offset += 4; - ret = dmg_read_mish_block(bs, &ds, offset, count); + ret = dmg_read_mish_block(bs, ds, offset, count); if (ret < 0) { goto fail; } offset += count; } + return 0; + +fail: + return ret; +} + +static int dmg_open(BlockDriverState *bs, QDict *options, int flags, + Error **errp) +{ + BDRVDMGState *s = bs->opaque; + DmgHeaderState ds; + uint64_t rsrc_fork_offset, rsrc_fork_length; + int64_t offset; + int ret; + + bs->read_only = 1; + s->n_chunks = 0; + s->offsets = s->lengths = s->sectors = s->sectorcounts = NULL; + ds.last_in_offset = 0; + ds.last_out_offset = 0; + ds.max_compressed_size = 1; + ds.max_sectors_per_chunk = 1; + + /* locate the UDIF trailer */ + offset = dmg_find_koly_offset(bs->file); + if (offset < 0) { + ret = offset; + goto fail; + } + + /* offset of resource fork (RsrcForkOffset) */ + ret = read_uint64(bs, offset + 0x28, &rsrc_fork_offset); + if (ret < 0) { + goto fail; + } + ret = read_uint64(bs, offset + 0x30, &rsrc_fork_length); + if (ret < 0) { + goto fail; + } + if (rsrc_fork_offset != 0 && rsrc_fork_length != 0) { + ret = dmg_read_resource_fork(bs, &ds, + rsrc_fork_offset, rsrc_fork_length); + if (ret < 0) { + goto fail; + } + } else { + ret = -EINVAL; + goto fail; + } /* initialize zlib engine */ s->compressed_chunk = qemu_try_blockalign(bs->file, -- 2.2.1