From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:58199) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Y8uzD-0002It-St for qemu-devel@nongnu.org; Wed, 07 Jan 2015 13:05:43 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1Y8uzC-0005hX-Ox for qemu-devel@nongnu.org; Wed, 07 Jan 2015 13:05:39 -0500 Received: from mx1.redhat.com ([209.132.183.28]:33006) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Y8uzC-0005hT-GA for qemu-devel@nongnu.org; Wed, 07 Jan 2015 13:05:38 -0500 Message-ID: <54AD756D.3060309@redhat.com> Date: Wed, 07 Jan 2015 13:05:33 -0500 From: John Snow MIME-Version: 1.0 References: <1420566495-13284-1-git-send-email-peter@lekensteyn.nl> <1420566495-13284-6-git-send-email-peter@lekensteyn.nl> In-Reply-To: <1420566495-13284-6-git-send-email-peter@lekensteyn.nl> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] [PATCH v2 05/12] block/dmg: validate chunk size to avoid overflow List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Peter Wu , qemu-devel@nongnu.org Cc: Kevin Wolf , Stefan Hajnoczi On 01/06/2015 12:48 PM, Peter Wu wrote: > Previously the chunk size was not checked, allowing for a large memory > allocation. This patch checks whether the chunks size is within the > resource fork length, and whether the resource fork is below the > trailer of the dmg file. > > Signed-off-by: Peter Wu > --- > v2: added resource fork offset check > --- > block/dmg.c | 7 ++++++- > 1 file changed, 6 insertions(+), 1 deletion(-) > > diff --git a/block/dmg.c b/block/dmg.c > index 4913249..5f6976b 100644 > --- a/block/dmg.c > +++ b/block/dmg.c > @@ -319,7 +319,7 @@ static int dmg_read_resource_fork(BlockDriverState *bs, DmgHeaderState *ds, > ret = read_uint32(bs, offset, &count); > if (ret < 0) { > goto fail; > - } else if (count == 0) { > + } else if (count == 0 || count > info_end - offset) { > ret = -EINVAL; > goto fail; > } > @@ -379,6 +379,11 @@ static int dmg_open(BlockDriverState *bs, QDict *options, int flags, > if (ret < 0) { > goto fail; > } > + if (rsrc_fork_offset >= offset || > + rsrc_fork_length > offset - rsrc_fork_offset) { > + ret = -EINVAL; > + goto fail; > + } > if (rsrc_fork_length != 0) { > ret = dmg_read_resource_fork(bs, &ds, > rsrc_fork_offset, rsrc_fork_length); > Reviewed-by: John Snow