]> rtime.felk.cvut.cz Git - lisovros/qemu_apohw.git/commit
vhdx: Bounds checking for block_size and logical_sector_size (CVE-2014-0148)
authorJeff Cody <jcody@redhat.com>
Wed, 26 Mar 2014 12:05:39 +0000 (13:05 +0100)
committerMichael Roth <mdroth@linux.vnet.ibm.com>
Thu, 3 Jul 2014 21:18:11 +0000 (16:18 -0500)
commit1786c4225db1ff1241d76e1f96a2acc1bea51d2d
tree2c169746f563d5a159a373d766c34600fd23852a
parent37173f54b7925f02045a93c081deabca1b8a6abd
vhdx: Bounds checking for block_size and logical_sector_size (CVE-2014-0148)

Other variables (e.g. sectors_per_block) are calculated using these
variables, and if not range-checked illegal values could be obtained
causing infinite loops and other potential issues when calculating
BAT entries.

The 1.00 VHDX spec requires BlockSize to be min 1MB, max 256MB.
LogicalSectorSize is required to be either 512 or 4096 bytes.

Reported-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Jeff Cody <jcody@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
(cherry picked from commit 1d7678dec4761acdc43439da6ceda41a703ba1a6)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
block/vhdx.c