From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43)
	id 1JE8fZ-0000qv-DW
	for qemu-devel@nongnu.org; Sun, 13 Jan 2008 14:38:57 -0500
Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43)
	id 1JE8fY-0000qI-R2
	for qemu-devel@nongnu.org; Sun, 13 Jan 2008 14:38:56 -0500
Received: from [199.232.76.173] (helo=monty-python.gnu.org)
	by lists.gnu.org with esmtp (Exim 4.43) id 1JE8fY-0000q8-Hf
	for qemu-devel@nongnu.org; Sun, 13 Jan 2008 14:38:56 -0500
Received: from fg-out-1718.google.com ([72.14.220.157])
	by monty-python.gnu.org with esmtp (Exim 4.60)
	(envelope-from <emilliken@gmail.com>) id 1JE8fY-0004A5-CC
	for qemu-devel@nongnu.org; Sun, 13 Jan 2008 14:38:56 -0500
Received: by fg-out-1718.google.com with SMTP id e12so2048018fga.8
	for <qemu-devel@nongnu.org>; Sun, 13 Jan 2008 11:38:54 -0800 (PST)
Message-ID: <f6979bd0801131138u47f53510q7d87b61f74086f0f@mail.gmail.com>
Date: Sun, 13 Jan 2008 14:38:54 -0500
From: "Eric Milliken" <emilliken@gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Subject: [Qemu-devel] [PATCH] fix heap overflow in block-vmdk.c
Reply-To: qemu-devel@nongnu.org
List-Id: qemu-devel.nongnu.org
List-Unsubscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.gnu.org/pipermail/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: qemu-devel@nongnu.org

It's possible to set a parentFileNameHint argument > 1023 bytes in the
image file, causing an overflow at the strncpy.

diff -ru qemu-0.9.1/block-vmdk.c qemu-0.9.1-p/block-vmdk.c
--- qemu-0.9.1/block-vmdk.c     2008-01-06 14:38:42.000000000 -0500
+++ qemu-0.9.1-p/block-vmdk.c   2008-01-13 14:30:23.000000000 -0500
@@ -342,6 +342,9 @@
         if ((end_name = strchr(p_name,'\"')) == 0)
             return -1;

+        if ((end_name - p_name) > sizeof (s->hd->backing_file) - 1)
+          return -1;
+
         strncpy(s->hd->backing_file, p_name, end_name - p_name);
         if (stat(s->hd->backing_file, &file_buf) != 0) {
             path_combine(parent_img_name, sizeof(parent_img_name),