1. 19 5月, 2014 2 次提交
    • K
      qcow1: Validate L2 table size (CVE-2014-0222) · 42eb5817
      Kevin Wolf 提交于
      Too large L2 table sizes cause unbounded allocations. Images actually
      created by qemu-img only have 512 byte or 4k L2 tables.
      
      To keep things consistent with cluster sizes, allow ranges between 512
      bytes and 64k (in fact, down to 1 entry = 8 bytes is technically
      working, but L2 table sizes smaller than a cluster don't make a lot of
      sense).
      
      This also means that the number of bytes on the virtual disk that are
      described by the same L2 table is limited to at most 8k * 64k or 2^29,
      preventively avoiding any integer overflows.
      
      Cc: qemu-stable@nongnu.org
      Signed-off-by: NKevin Wolf <kwolf@redhat.com>
      Reviewed-by: NBenoit Canet <benoit@irqsave.net>
      42eb5817
    • K
      qcow1: Check maximum cluster size · 7159a45b
      Kevin Wolf 提交于
      Huge values for header.cluster_bits cause unbounded allocations (e.g.
      for s->cluster_cache) and crash qemu this way. Less huge values may
      survive those allocations, but can cause integer overflows later on.
      
      The only cluster sizes that qemu can create are 4k (for standalone
      images) and 512 (for images with backing files), so we can limit it
      to 64k.
      
      Cc: qemu-stable@nongnu.org
      Signed-off-by: NKevin Wolf <kwolf@redhat.com>
      Reviewed-by: NBenoit Canet <benoit@irqsave.net>
      7159a45b