From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([2001:4830:134:3::10]:54826)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <kwolf@redhat.com>) id 1Yqft3-0005gj-Ie
	for qemu-devel@nongnu.org; Fri, 08 May 2015 06:52:10 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <kwolf@redhat.com>) id 1Yqft2-00030h-Rq
	for qemu-devel@nongnu.org; Fri, 08 May 2015 06:52:09 -0400
Date: Fri, 8 May 2015 12:52:00 +0200
From: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20150508105200.GG4318@noname.redhat.com>
References: <1430818093-10346-1-git-send-email-famz@redhat.com>
	<554A5462.7010103@redhat.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <554A5462.7010103@redhat.com>
Subject: Re: [Qemu-devel] [Qemu-block] [PATCH] vmdk: Fix overflow if l1_size
	is 0x20000000
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: Max Reitz <mreitz@redhat.com>
Cc: qemu-stable@nongnu.org, Fam Zheng <famz@redhat.com>, qemu-devel@nongnu.org, qemu-block@nongnu.org, rjones@redhat.com

Am 06.05.2015 um 19:50 hat Max Reitz geschrieben:
> On 05.05.2015 11:28, Fam Zheng wrote:
> >Richard Jones caught this bug with afl fuzzer.
> >
> >In fact, that's the only possible value to overflow (extent->l1_size =
> >0x20000000) l1_size:
> >
> >l1_size = extent->l1_size * sizeof(long) => 0x80000000;
> >
> >g_try_malloc returns NULL because l1_size is interpreted as negative
> >during type casting from 'int' to 'gsize', which yields a enormous
> >value. Hence, by coincidence, we get a "not too bad" behavior:
> >
> >qemu-img: Could not open '/tmp/afl6.img': Could not open
> >'/tmp/afl6.img': Cannot allocate memory
> >
> >Values larger than 0x20000000 will be refused by the validation in
> >vmdk_add_extent.
> >
> >Values smaller than 0x20000000 will not overflow l1_size.
> >
> >Reported-by: Richard W.M. Jones <rjones@redhat.com>
> >Signed-off-by: Fam Zheng <famz@redhat.com>
> >---
> >  block/vmdk.c | 3 ++-
> >  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> Okay, so because size_t is unsigned, this will not overflow on
> systems with sizeof(size_t) == 4 either.
> 
> Reviewed-by: Max Reitz <mreitz@redhat.com>

Thanks, applied to the block branch. I think this one is for stable,
too.

Kevin