| commit | 274fb0e1ed962e9ae43ab05e7939499cebb39d26 | |
| author | aliguori <aliguori@c046a42c-6fe2-441c-8c8c-71466251a162> | |
| Thu, 29 Jan 2009 19:59:04 +0000 (29 19:59 +0000) | ||
| committer | aliguori <aliguori@c046a42c-6fe2-441c-8c8c-71466251a162> | |
| Thu, 29 Jan 2009 19:59:04 +0000 (29 19:59 +0000) | ||
| tree | e05f4ec3dfaaff8ebfb05bea5773e17e21ad0ca2 | treesnapshot (tar.gz zip) |
| parent | 33049de7827e9b85c53cf12e841bb619b832340f | commitdiff |
check SCSI read/write requests against max LBA (Rik van Riel)
The bdrv layer uses a signed offset. Furthermore, block-raw-posix
only seeks when that offset is positive. Passing a negative offset
to block-raw-posix can result in data being written at the current
seek cursor's position.
It may be possible to exploit this to seek to the end of the disk
and extend the virtual disk by writing data to a negative sector
offset. After a reboot, this could lead to the guest having a
larger disk than it had before.
Close the hole by sanity checking the lba against the size of the
disk.
Signed-off-by: Rik van Riel <riel@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@6475 c046a42c-6fe2-441c-8c8c-71466251a162
The bdrv layer uses a signed offset. Furthermore, block-raw-posix
only seeks when that offset is positive. Passing a negative offset
to block-raw-posix can result in data being written at the current
seek cursor's position.
It may be possible to exploit this to seek to the end of the disk
and extend the virtual disk by writing data to a negative sector
offset. After a reboot, this could lead to the guest having a
larger disk than it had before.
Close the hole by sanity checking the lba against the size of the
disk.
Signed-off-by: Rik van Riel <riel@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@6475 c046a42c-6fe2-441c-8c8c-71466251a162
| hw/scsi-disk.c | diffblobblamehistory |