From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:38413) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Z7qko-000361-Cz for qemu-devel@nongnu.org; Wed, 24 Jun 2015 15:54:39 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1Z7qkn-0006WD-JZ for qemu-devel@nongnu.org; Wed, 24 Jun 2015 15:54:38 -0400 From: Jeff Cody Date: Wed, 24 Jun 2015 15:54:26 -0400 Message-Id: Subject: [Qemu-devel] [PATCH 0/2] block: vpc - prevent overflow List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: kwolf@redhat.com, qemu-block@nongnu.org This series fixes a bug found by Richard Jones. When we allocate the pagetable based on max_table_entries, we multiply the max table entry value by 4 to accomodate a table of 32-bit integers. However, max_table_entries is a uint32_t, and the VPC driver accepts ranges for that entry over 0x40000000. So during this allocation: s->pagetable = qemu_try_blockalign(bs->file, s->max_table_entries * 4); The size arg overflows, allocating significantly less memory than expected. Since qemu_try_blockalign() size argument is size_t, cast the multiplication correctly to prevent overflow. The value of "max_table_entries * 4" is used elsewhere in the code as well, so store the correct value for use in all those cases. Jeff Cody (2): block: vpc - prevent overflow if max_table_entries >= 0x40000000 block: qemu-iotests - add check for multiplication overflow in vpc block/vpc.c | 10 +++-- tests/qemu-iotests/135 | 54 ++++++++++++++++++++++++++ tests/qemu-iotests/135.out | 5 +++ tests/qemu-iotests/group | 1 + tests/qemu-iotests/sample_images/afl5.img.bz2 | Bin 0 -> 175 bytes 5 files changed, 66 insertions(+), 4 deletions(-) create mode 100755 tests/qemu-iotests/135 create mode 100644 tests/qemu-iotests/135.out create mode 100644 tests/qemu-iotests/sample_images/afl5.img.bz2 -- 1.9.3