| commit | 97f1c45c6f456572e5b504b8614e4a69e23b8e3a | |
| author | Jeff Cody <jcody@redhat.com> | |
| Wed, 26 Mar 2014 12:05:36 +0000 (26 13:05 +0100) | ||
| committer | Stefan Hajnoczi <stefanha@redhat.com> | |
| Tue, 1 Apr 2014 11:59:47 +0000 (1 13:59 +0200) | ||
| tree | 403d8ec49f195d59319b074da4ecbf08358f3194 | treesnapshot (tar.gz zip) |
| parent | a9ba36a45dfac645a810c31ce15ab393b69d820a | commitdiff |
vpc/vhd: add bounds check for max_table_entries and block_size (CVE-2014-0144)
This adds checks to make sure that max_table_entries and block_size
are in sane ranges. Memory is allocated based on max_table_entries,
and block_size is used to calculate indices into that allocated
memory, so if these values are incorrect that can lead to potential
unbounded memory allocation, or invalid memory accesses.
Also, the allocation of the pagetable is changed from g_malloc0()
to qemu_blockalign().
Signed-off-by: Jeff Cody <jcody@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
This adds checks to make sure that max_table_entries and block_size
are in sane ranges. Memory is allocated based on max_table_entries,
and block_size is used to calculate indices into that allocated
memory, so if these values are incorrect that can lead to potential
unbounded memory allocation, or invalid memory accesses.
Also, the allocation of the pagetable is changed from g_malloc0()
to qemu_blockalign().
Signed-off-by: Jeff Cody <jcody@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
| block/vpc.c | diffblobblamehistory |