vpc/vhd: add bounds check for max_table_entries and block_size (CVE-2014-0144)
commit97f1c45c6f456572e5b504b8614e4a69e23b8e3a
authorJeff Cody <jcody@redhat.com>
Wed, 26 Mar 2014 12:05:36 +0000 (26 13:05 +0100)
committerStefan Hajnoczi <stefanha@redhat.com>
Tue, 1 Apr 2014 11:59:47 +0000 (1 13:59 +0200)
tree403d8ec49f195d59319b074da4ecbf08358f3194
parenta9ba36a45dfac645a810c31ce15ab393b69d820a
vpc/vhd: add bounds check for max_table_entries and block_size (CVE-2014-0144)

This adds checks to make sure that max_table_entries and block_size
are in sane ranges.  Memory is allocated based on max_table_entries,
and block_size is used to calculate indices into that allocated
memory, so if these values are incorrect that can lead to potential
unbounded memory allocation, or invalid memory accesses.

Also, the allocation of the pagetable is changed from g_malloc0()
to qemu_blockalign().

Signed-off-by: Jeff Cody <jcody@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
block/vpc.c