From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([2001:4830:134:3::10]:41667)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <mreitz@redhat.com>) id 1WTfwm-00086S-ID
	for qemu-devel@nongnu.org; Fri, 28 Mar 2014 19:12:30 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <mreitz@redhat.com>) id 1WTfwg-0001Cp-Cl
	for qemu-devel@nongnu.org; Fri, 28 Mar 2014 19:12:24 -0400
Message-ID: <533601CD.9030400@redhat.com>
Date: Sat, 29 Mar 2014 00:12:13 +0100
From: Max Reitz <mreitz@redhat.com>
MIME-Version: 1.0
References: <1395835569-21193-1-git-send-email-stefanha@redhat.com>
	<1395835569-21193-39-git-send-email-stefanha@redhat.com>
In-Reply-To: <1395835569-21193-39-git-send-email-stefanha@redhat.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [Qemu-devel] [PATCH for-2.0 38/47] dmg: prevent chunk buffer
 overflow (CVE-2014-0145)
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: Stefan Hajnoczi <stefanha@redhat.com>, qemu-devel@nongnu.org
Cc: Kevin Wolf <kwolf@redhat.com>, pmatouse@redhat.com, qemu-stable@nongnu.org

On 26.03.2014 13:06, Stefan Hajnoczi wrote:
> Both compressed and uncompressed I/O is buffered.  dmg_open() calculates
> the maximum buffer size needed from the metadata in the image file.
>
> There is currently a buffer overflow since ->lengths[] is accounted
> against the maximum compressed buffer size but actually uses the
> uncompressed buffer:
>
>    switch (s->types[chunk]) {
>    case 1: /* copy */
>        ret = bdrv_pread(bs->file, s->offsets[chunk],
>                         s->uncompressed_chunk, s->lengths[chunk]);
>
> We must account against the maximum uncompressed buffer size for type=1
> chunks.
>
> This patch fixes the maximum buffer size calculation to take into
> account the chunk type.  It is critical that we update the correct
> maximum since there are two buffers ->compressed_chunk and
> ->uncompressed_chunk.
>
> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
> ---
>   block/dmg.c | 39 +++++++++++++++++++++++++++++++++------
>   1 file changed, 33 insertions(+), 6 deletions(-)

Reviewed-by: Max Reitz <mreitz@redhat.com>