0a122b
From 6d68fdd3f1fa51b2f1524f1984089057e6d1b081 Mon Sep 17 00:00:00 2001
0a122b
From: Kevin Wolf <kwolf@redhat.com>
0a122b
Date: Tue, 25 Mar 2014 14:23:48 +0100
0a122b
Subject: [PATCH 41/49] block: Limit request size (CVE-2014-0143)
0a122b
0a122b
RH-Author: Kevin Wolf <kwolf@redhat.com>
0a122b
Message-id: <1395753835-7591-42-git-send-email-kwolf@redhat.com>
0a122b
Patchwork-id: n/a
0a122b
O-Subject: [virt-devel] [EMBARGOED RHEL-7.0 qemu-kvm PATCH 41/48] block: Limit request size (CVE-2014-0143)
0a122b
Bugzilla: 1079320
0a122b
RH-Acked-by: Jeff Cody <jcody@redhat.com>
0a122b
RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
0a122b
RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
0a122b
0a122b
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1079320
0a122b
Upstream status: Embargoed
0a122b
0a122b
Limiting the size of a single request to INT_MAX not only fixes a
0a122b
direct integer overflow in bdrv_check_request() (which would only
0a122b
trigger bad behaviour with ridiculously huge images, as in close to
0a122b
2^64 bytes), but can also prevent overflows in all block drivers.
0a122b
0a122b
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
0a122b
---
0a122b
 block.c |    4 ++++
0a122b
 1 files changed, 4 insertions(+), 0 deletions(-)
0a122b
0a122b
diff --git a/block.c b/block.c
0a122b
index 0321c74..4906f6b 100644
0a122b
--- a/block.c
0a122b
+++ b/block.c
0a122b
@@ -2425,6 +2425,10 @@ static int bdrv_check_byte_request(BlockDriverState *bs, int64_t offset,
0a122b
 static int bdrv_check_request(BlockDriverState *bs, int64_t sector_num,
0a122b
                               int nb_sectors)
0a122b
 {
0a122b
+    if (nb_sectors > INT_MAX / BDRV_SECTOR_SIZE) {
0a122b
+        return -EIO;
0a122b
+    }
0a122b
+
0a122b
     return bdrv_check_byte_request(bs, sector_num * BDRV_SECTOR_SIZE,
0a122b
                                    nb_sectors * BDRV_SECTOR_SIZE);
0a122b
 }
0a122b
-- 
0a122b
1.7.1
0a122b