|
 |
12cd54 |
From 6893e96e6b58d809a08c6491f76df221fd1a6473 Mon Sep 17 00:00:00 2001
|
|
|
12cd54 |
From: Kevin Wolf <kwolf@redhat.com>
|
|
|
12cd54 |
Date: Wed, 7 May 2014 17:30:30 +0200
|
|
|
12cd54 |
Subject: [PATCH] qcow1: Check maximum cluster size
|
|
|
12cd54 |
|
|
|
12cd54 |
Huge values for header.cluster_bits cause unbounded allocations (e.g.
|
|
|
12cd54 |
for s->cluster_cache) and crash qemu this way. Less huge values may
|
|
|
12cd54 |
survive those allocations, but can cause integer overflows later on.
|
|
|
12cd54 |
|
|
|
12cd54 |
The only cluster sizes that qemu can create are 4k (for standalone
|
|
|
12cd54 |
images) and 512 (for images with backing files), so we can limit it
|
|
|
12cd54 |
to 64k.
|
|
|
12cd54 |
|
|
|
12cd54 |
Cc: qemu-stable@nongnu.org
|
|
|
12cd54 |
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
|
|
|
12cd54 |
Reviewed-by: Benoit Canet <benoit@irqsave.net>
|
|
|
12cd54 |
(cherry picked from commit 7159a45b2bf2dcb9f49f1e27d1d3d135a0247a2f)
|
|
|
12cd54 |
|
|
|
12cd54 |
Conflicts:
|
|
|
12cd54 |
tests/qemu-iotests/group
|
|
|
12cd54 |
---
|
|
|
12cd54 |
block/qcow.c | 10 ++++++++--
|
|
|
12cd54 |
1 file changed, 8 insertions(+), 2 deletions(-)
|
|
|
12cd54 |
|
|
|
12cd54 |
diff --git a/block/qcow.c b/block/qcow.c
|
|
|
12cd54 |
index 9018f44..26bb923 100644
|
|
|
12cd54 |
--- a/block/qcow.c
|
|
|
12cd54 |
+++ b/block/qcow.c
|
|
|
12cd54 |
@@ -127,11 +127,17 @@ static int qcow_open(BlockDriverState *bs, QDict *options, int flags,
|
|
|
12cd54 |
goto fail;
|
|
|
12cd54 |
}
|
|
|
12cd54 |
|
|
|
12cd54 |
- if (header.size <= 1 || header.cluster_bits < 9) {
|
|
|
12cd54 |
- error_setg(errp, "invalid value in qcow header");
|
|
|
12cd54 |
+ if (header.size <= 1) {
|
|
|
12cd54 |
+ error_setg(errp, "Image size is too small (must be at least 2 bytes)");
|
|
|
12cd54 |
ret = -EINVAL;
|
|
|
12cd54 |
goto fail;
|
|
|
12cd54 |
}
|
|
|
12cd54 |
+ if (header.cluster_bits < 9 || header.cluster_bits > 16) {
|
|
|
12cd54 |
+ error_setg(errp, "Cluster size must be between 512 and 64k");
|
|
|
12cd54 |
+ ret = -EINVAL;
|
|
|
12cd54 |
+ goto fail;
|
|
|
12cd54 |
+ }
|
|
|
12cd54 |
+
|
|
|
12cd54 |
if (header.crypt_method > QCOW_CRYPT_AES) {
|
|
|
12cd54 |
error_setg(errp, "invalid encryption method in qcow header");
|
|
|
12cd54 |
ret = -EINVAL;
|