From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([2001:4830:134:3::10]:48072)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <mreitz@redhat.com>) id 1WTgTS-0003XI-Th
	for qemu-devel@nongnu.org; Fri, 28 Mar 2014 19:46:17 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <mreitz@redhat.com>) id 1WTgTM-00033y-Ch
	for qemu-devel@nongnu.org; Fri, 28 Mar 2014 19:46:10 -0400
Message-ID: <533609B4.8060307@redhat.com>
Date: Sat, 29 Mar 2014 00:45:56 +0100
From: Max Reitz <mreitz@redhat.com>
MIME-Version: 1.0
References: <1395835569-21193-1-git-send-email-stefanha@redhat.com>
	<1395835569-21193-47-git-send-email-stefanha@redhat.com>
In-Reply-To: <1395835569-21193-47-git-send-email-stefanha@redhat.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [Qemu-devel] [PATCH for-2.0 46/47] parallels: Fix catalog size
 integer overflow (CVE-2014-0143)
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: Stefan Hajnoczi <stefanha@redhat.com>, qemu-devel@nongnu.org
Cc: Kevin Wolf <kwolf@redhat.com>, pmatouse@redhat.com, qemu-stable@nongnu.org

On 26.03.2014 13:06, Stefan Hajnoczi wrote:
> From: Kevin Wolf <kwolf@redhat.com>
>
> The first test case would cause a huge memory allocation, leading to a
> qemu abort; the second one to a too small malloc() for the catalog
> (smaller than s->catalog_size), which causes a read-only out-of-bounds
> array access and on big endian hosts an endianess conversion for an
> undefined memory area.
>
> The sample image used here is not an original Parallels image. It was
> created using an hexeditor on the basis of the struct that qemu uses.
> Good enough for trying to crash the driver, but not for ensuring
> compatibility.
>
> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
> ---
>   block/parallels.c                                  |   7 ++-
>   tests/qemu-iotests/076                             |  69 +++++++++++++++++++++
>   tests/qemu-iotests/076.out                         |  14 +++++
>   tests/qemu-iotests/common                          |   7 +++
>   tests/qemu-iotests/group                           |   1 +
>   .../qemu-iotests/sample_images/fake.parallels.bz2  | Bin 0 -> 141 bytes
>   6 files changed, 97 insertions(+), 1 deletion(-)
>   create mode 100755 tests/qemu-iotests/076
>   create mode 100644 tests/qemu-iotests/076.out
>   create mode 100644 tests/qemu-iotests/sample_images/fake.parallels.bz2

Reviewed-by: Max Reitz <mreitz@redhat.com>