|
 |
0a122b |
From 6d68fdd3f1fa51b2f1524f1984089057e6d1b081 Mon Sep 17 00:00:00 2001
|
|
|
0a122b |
From: Kevin Wolf <kwolf@redhat.com>
|
|
|
0a122b |
Date: Tue, 25 Mar 2014 14:23:48 +0100
|
|
|
0a122b |
Subject: [PATCH 41/49] block: Limit request size (CVE-2014-0143)
|
|
|
0a122b |
|
|
|
0a122b |
RH-Author: Kevin Wolf <kwolf@redhat.com>
|
|
|
0a122b |
Message-id: <1395753835-7591-42-git-send-email-kwolf@redhat.com>
|
|
|
0a122b |
Patchwork-id: n/a
|
|
|
0a122b |
O-Subject: [virt-devel] [EMBARGOED RHEL-7.0 qemu-kvm PATCH 41/48] block: Limit request size (CVE-2014-0143)
|
|
|
0a122b |
Bugzilla: 1079320
|
|
|
0a122b |
RH-Acked-by: Jeff Cody <jcody@redhat.com>
|
|
|
0a122b |
RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
|
|
|
0a122b |
RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
|
|
|
0a122b |
|
|
|
0a122b |
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1079320
|
|
|
0a122b |
Upstream status: Embargoed
|
|
|
0a122b |
|
|
|
0a122b |
Limiting the size of a single request to INT_MAX not only fixes a
|
|
|
0a122b |
direct integer overflow in bdrv_check_request() (which would only
|
|
|
0a122b |
trigger bad behaviour with ridiculously huge images, as in close to
|
|
|
0a122b |
2^64 bytes), but can also prevent overflows in all block drivers.
|
|
|
0a122b |
|
|
|
0a122b |
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
|
|
|
0a122b |
---
|
|
|
0a122b |
block.c | 4 ++++
|
|
|
0a122b |
1 files changed, 4 insertions(+), 0 deletions(-)
|
|
|
0a122b |
|
|
|
0a122b |
diff --git a/block.c b/block.c
|
|
|
0a122b |
index 0321c74..4906f6b 100644
|
|
|
0a122b |
--- a/block.c
|
|
|
0a122b |
+++ b/block.c
|
|
|
0a122b |
@@ -2425,6 +2425,10 @@ static int bdrv_check_byte_request(BlockDriverState *bs, int64_t offset,
|
|
|
0a122b |
static int bdrv_check_request(BlockDriverState *bs, int64_t sector_num,
|
|
|
0a122b |
int nb_sectors)
|
|
|
0a122b |
{
|
|
|
0a122b |
+ if (nb_sectors > INT_MAX / BDRV_SECTOR_SIZE) {
|
|
|
0a122b |
+ return -EIO;
|
|
|
0a122b |
+ }
|
|
|
0a122b |
+
|
|
|
0a122b |
return bdrv_check_byte_request(bs, sector_num * BDRV_SECTOR_SIZE,
|
|
|
0a122b |
nb_sectors * BDRV_SECTOR_SIZE);
|
|
|
0a122b |
}
|
|
|
0a122b |
--
|
|
|
0a122b |
1.7.1
|
|
|
0a122b |
|