From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([208.118.235.92]:34647)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <stefanha@gmail.com>) id 1S2JrJ-0008Qb-VG
	for qemu-devel@nongnu.org; Tue, 28 Feb 2012 05:00:39 -0500
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <stefanha@gmail.com>) id 1S2JrF-0008RR-3w
	for qemu-devel@nongnu.org; Tue, 28 Feb 2012 05:00:37 -0500
Received: from mail-lpp01m010-f45.google.com ([209.85.215.45]:53229)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <stefanha@gmail.com>) id 1S2JrE-0008R3-PY
	for qemu-devel@nongnu.org; Tue, 28 Feb 2012 05:00:33 -0500
Received: by lahe6 with SMTP id e6so1532637lah.4
	for <qemu-devel@nongnu.org>; Tue, 28 Feb 2012 02:00:30 -0800 (PST)
MIME-Version: 1.0
In-Reply-To: <4F4CA2C1.7070708@redhat.com>
References: <1330360065-27334-1-git-send-email-kwolf@redhat.com>
	<CAJSP0QWspNM+ESSGjzW1KSXcHJp8RUU+BQxrRzwyZ6cqPVMx1g@mail.gmail.com>
	<4F4CA2C1.7070708@redhat.com>
Date: Tue, 28 Feb 2012 10:00:30 +0000
Message-ID: <CAJSP0QV6j1faNieLpWa2Dw_0uYVxEVkPnuys6pn6zAT0y-JBcA@mail.gmail.com>
From: Stefan Hajnoczi <stefanha@gmail.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Subject: Re: [Qemu-devel] [PATCH] qcow2: Reject unrealistically large header
	extensions
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: Kevin Wolf <kwolf@redhat.com>
Cc: qemu-devel@nongnu.org

On Tue, Feb 28, 2012 at 9:47 AM, Kevin Wolf <kwolf@redhat.com> wrote:
> Am 28.02.2012 10:33, schrieb Stefan Hajnoczi:
>> On Mon, Feb 27, 2012 at 4:27 PM, Kevin Wolf <kwolf@redhat.com> wrote:
>>> + =A0 =A0 =A0 =A0if (ext.len > 65536) {
>>> + =A0 =A0 =A0 =A0 =A0 =A0error_report("Header extension larger than 64k=
 - this looks wrong");
>>> + =A0 =A0 =A0 =A0 =A0 =A0return -ENOTSUP;
>>> + =A0 =A0 =A0 =A0}
>>
>> This is an implementation limit and not in the spec, but I think it's
>> reasonable.
>>
>> Reviewed-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
>
> Hm, actually, now that I look at this patch again, I think there's a
> much better error condition that even matches the spec:
>
> =A0 =A0if (offset + ext.len > end_offset)

Careful, integer overflow.

Stefan