|
 |
0a122b |
From abf79316045a3c634e9633553942763fd358f9b2 Mon Sep 17 00:00:00 2001
|
|
|
0a122b |
From: Kevin Wolf <kwolf@redhat.com>
|
|
|
0a122b |
Date: Tue, 25 Mar 2014 14:23:18 +0100
|
|
|
0a122b |
Subject: [PATCH 11/49] bochs: Use unsigned variables for offsets and sizes (CVE-2014-0147)
|
|
|
0a122b |
|
|
|
0a122b |
RH-Author: Kevin Wolf <kwolf@redhat.com>
|
|
|
0a122b |
Message-id: <1395753835-7591-12-git-send-email-kwolf@redhat.com>
|
|
|
0a122b |
Patchwork-id: n/a
|
|
|
0a122b |
O-Subject: [virt-devel] [EMBARGOED RHEL-7.0 qemu-kvm PATCH 11/48] bochs: Use unsigned variables for offsets and sizes (CVE-2014-0147)
|
|
|
0a122b |
Bugzilla: 1079339
|
|
|
0a122b |
RH-Acked-by: Jeff Cody <jcody@redhat.com>
|
|
|
0a122b |
RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
|
|
|
0a122b |
RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
|
|
|
0a122b |
|
|
|
0a122b |
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1079339
|
|
|
0a122b |
Upstream status: Embargoed
|
|
|
0a122b |
|
|
|
0a122b |
Gets us rid of integer overflows resulting in negative sizes which
|
|
|
0a122b |
aren't correctly checked.
|
|
|
0a122b |
|
|
|
0a122b |
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
|
|
|
0a122b |
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
|
|
|
0a122b |
---
|
|
|
0a122b |
block/bochs.c | 16 ++++++++--------
|
|
|
0a122b |
tests/qemu-iotests/078 | 8 ++++++++
|
|
|
0a122b |
tests/qemu-iotests/078.out | 4 ++++
|
|
|
0a122b |
3 files changed, 20 insertions(+), 8 deletions(-)
|
|
|
0a122b |
|
|
|
0a122b |
diff --git a/block/bochs.c b/block/bochs.c
|
|
|
0a122b |
index 708780d..04cca71 100644
|
|
|
0a122b |
--- a/block/bochs.c
|
|
|
0a122b |
+++ b/block/bochs.c
|
|
|
0a122b |
@@ -67,13 +67,13 @@ struct bochs_header {
|
|
|
0a122b |
typedef struct BDRVBochsState {
|
|
|
0a122b |
CoMutex lock;
|
|
|
0a122b |
uint32_t *catalog_bitmap;
|
|
|
0a122b |
- int catalog_size;
|
|
|
0a122b |
+ uint32_t catalog_size;
|
|
|
0a122b |
|
|
|
0a122b |
- int data_offset;
|
|
|
0a122b |
+ uint32_t data_offset;
|
|
|
0a122b |
|
|
|
0a122b |
- int bitmap_blocks;
|
|
|
0a122b |
- int extent_blocks;
|
|
|
0a122b |
- int extent_size;
|
|
|
0a122b |
+ uint32_t bitmap_blocks;
|
|
|
0a122b |
+ uint32_t extent_blocks;
|
|
|
0a122b |
+ uint32_t extent_size;
|
|
|
0a122b |
} BDRVBochsState;
|
|
|
0a122b |
|
|
|
0a122b |
static int bochs_probe(const uint8_t *buf, int buf_size, const char *filename)
|
|
|
0a122b |
@@ -97,7 +97,7 @@ static int bochs_open(BlockDriverState *bs, QDict *options, int flags,
|
|
|
0a122b |
Error **errp)
|
|
|
0a122b |
{
|
|
|
0a122b |
BDRVBochsState *s = bs->opaque;
|
|
|
0a122b |
- int i;
|
|
|
0a122b |
+ uint32_t i;
|
|
|
0a122b |
struct bochs_header bochs;
|
|
|
0a122b |
int ret;
|
|
|
0a122b |
|
|
|
0a122b |
@@ -152,8 +152,8 @@ fail:
|
|
|
0a122b |
static int64_t seek_to_sector(BlockDriverState *bs, int64_t sector_num)
|
|
|
0a122b |
{
|
|
|
0a122b |
BDRVBochsState *s = bs->opaque;
|
|
|
0a122b |
- int64_t offset = sector_num * 512;
|
|
|
0a122b |
- int64_t extent_index, extent_offset, bitmap_offset;
|
|
|
0a122b |
+ uint64_t offset = sector_num * 512;
|
|
|
0a122b |
+ uint64_t extent_index, extent_offset, bitmap_offset;
|
|
|
0a122b |
char bitmap_entry;
|
|
|
0a122b |
|
|
|
0a122b |
// seek to sector
|
|
|
0a122b |
diff --git a/tests/qemu-iotests/078 b/tests/qemu-iotests/078
|
|
|
0a122b |
index f55f46d..73b573a 100755
|
|
|
0a122b |
--- a/tests/qemu-iotests/078
|
|
|
0a122b |
+++ b/tests/qemu-iotests/078
|
|
|
0a122b |
@@ -42,11 +42,19 @@ _supported_fmt bochs
|
|
|
0a122b |
_supported_proto generic
|
|
|
0a122b |
_supported_os Linux
|
|
|
0a122b |
|
|
|
0a122b |
+catalog_size_offset=$((0x48))
|
|
|
0a122b |
+
|
|
|
0a122b |
echo
|
|
|
0a122b |
echo "== Read from a valid image =="
|
|
|
0a122b |
_use_sample_img empty.bochs.bz2
|
|
|
0a122b |
{ $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
|
|
|
0a122b |
|
|
|
0a122b |
+echo
|
|
|
0a122b |
+echo "== Negative catalog size =="
|
|
|
0a122b |
+_use_sample_img empty.bochs.bz2
|
|
|
0a122b |
+poke_file "$TEST_IMG" "$catalog_size_offset" "\xff\xff\xff\xff"
|
|
|
0a122b |
+{ $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
|
|
|
0a122b |
+
|
|
|
0a122b |
# success, all done
|
|
|
0a122b |
echo "*** done"
|
|
|
0a122b |
rm -f $seq.full
|
|
|
0a122b |
diff --git a/tests/qemu-iotests/078.out b/tests/qemu-iotests/078.out
|
|
|
0a122b |
index 25d37c5..ef8c42d 100644
|
|
|
0a122b |
--- a/tests/qemu-iotests/078.out
|
|
|
0a122b |
+++ b/tests/qemu-iotests/078.out
|
|
|
0a122b |
@@ -3,4 +3,8 @@ QA output created by 078
|
|
|
0a122b |
== Read from a valid image ==
|
|
|
0a122b |
read 512/512 bytes at offset 0
|
|
|
0a122b |
512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
|
|
|
0a122b |
+
|
|
|
0a122b |
+== Negative catalog size ==
|
|
|
0a122b |
+qemu-io: can't open device TEST_DIR/empty.bochs: Could not open 'TEST_DIR/empty.bochs': Interrupted system call
|
|
|
0a122b |
+no file open, try 'help open'
|
|
|
0a122b |
*** done
|
|
|
0a122b |
--
|
|
|
0a122b |
1.7.1
|
|
|
0a122b |
|